MAL-2026-19259: Malicious code in qap793gl4l (PyPI)

--- -= Per source details. Do not edit below this line.=-

Source: kam193 (3b70be66ff6d01cbf23ac275f3311a3ce40aa24fad549f7b742266d881998946) Continuation of a campaign executing remote code. During analysis of this package, the remote Github repository did not yet host the malicious code.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-testing1345

Reasons (based on the campaign):

- The package overrides the install command in setup.py to execute malicious code during installation.

- Downloads and executes a remote malicious script.

- rat