MAL-2026-19247: Malicious code in testing1345 (PyPI)

Published Nov 13, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: kam193 (15bab830cd8343859ac220ef87e821719169a4e2ccb50da37032d97ef02c27dd) During installation, the package downloads and executes a script from a remote location. The server delivers different payload versions, some of them being benign, and others containing next-stage installation. The final payload is a RAT.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-testing1345

Reasons (based on the campaign):

- Downloads and executes a remote malicious script.

- The package overrides the install command in setup.py to execute malicious code during installation.

- rat

Affected Software

1 affected component

pip/testing1345=0.1.0

Event History

Nov 13, 2026

Advisory Published

via OSV·05:50 PM

Data Sourced

via OSV·05:50 PM

DescriptionAffected Software

Frequently Asked Questions

When does the malicious behavior run?

It runs during installation. The package overrides the setup.py install command to download and execute a script from a remote location, so no separate post-install action is described as necessary.

Which systems are realistically exposed?

Systems on which the testing1345 package is installed through pip are exposed to the installation-time code execution. The downloaded payload can vary because the remote server delivers different payload versions, including next-stage installation that results in a RAT.

How can I determine whether an environment may have been affected?

Check whether testing1345 was installed in the environment, as installation triggers the malicious code. The available data does not provide host indicators, file names, network indicators, or a fixed payload hash for confirming compromise.

Is there a known safe version or workaround?

No safe version, patched release, or workaround is identified in the available data. The package should not be installed because its installation command executes remotely supplied code.

MAL-2026-19247: Malicious code in testing1345 (PyPI)

Affected Software

Event History

Frequently Asked Questions

When does the malicious behavior run?

Which systems are realistically exposed?

How can I determine whether an environment may have been affected?

Is there a known safe version or workaround?

Company

Resources

Contact

Frequently Asked Questions

When does the malicious behavior run?

Which systems are realistically exposed?

How can I determine whether an environment may have been affected?

Is there a known safe version or workaround?