{"id":"MAL-2026-10758","title":"Malicious code in mfq-private-encoder (PyPI)","summary":"Malicious code in mfq-private-encoder (PyPI)","severity":"none","vendor":"mfq-private-encoder","product":"mfq-private-encoder","ecosystem":"pip","affected":["mfq-private-encoder"],"published":"2026-07-16","updated":"2026-07-16","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-10758","references":[{"url":"https://pypi.org/project/MFQ-Private-Encoder/1.0.0/"}],"tags":["osv","pip"],"ingestedAt":"2026-07-17T13:07:04.335Z","slug":"MAL-2026-10758","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6f2c0f78a3c5677481645e05e125f32273435610a1208a17ca4f852cb7f56b0e)\nThe package advertises a Python source-code encoder but has no local codec. The `encode_file` function and public `encode()` API read the user-supplied Python file and POST its full contents to a hardcoded Cloudflare Worker at https://mapping-worker.email-ecf.workers.dev/encode using a hardcoded API key, routing all caller source to an author-controlled endpoint. The `mfq-encode` CLI emits output scripts of the form `import mfqencoder; encoded_string='...'; exec(mfqencoder.decode(encoded_string))`, where `mfqencoder.decode` POSTs to https://mapping-worker.email-ecf.workers.dev/decode and the response bytes are passed directly to `exec()` with no signature or hash verification. Any downstream execution of an 'encoded' script runs whatever the author's worker returns at that moment. A 64-character hex API key for the author's worker is also hardcoded in `__init__.py`, `encoder.py`, and `decoder.py`.\n\n\n## Affected packages\n\n- `mfq-private-encoder`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}