{"id":"MAL-2026-13487","title":"Malicious code in flasq (PyPI)","summary":"Malicious code in flasq (PyPI)","severity":"none","vendor":"flasq","product":"flasq","ecosystem":"pip","affected":["flasq"],"published":"2026-08-07","updated":"2026-08-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-13487","references":[{"url":"https://www.virustotal.com/gui/file/425f5336182e359211b5d751786d2ce1d31a673ea9c82107358a888803742649/detection"},{"url":"https://bad-packages.kam193.eu/pypi/package/flasq"},{"url":"https://tria.ge/260807-fkycrazzg1/behavioral1"},{"url":"https://pypi.org/project/flasq/0.1.2/"},{"url":"https://pypi.org/project/flasq/0.1.1/"},{"url":"https://pypi.org/project/flasq/0.2.0/"},{"url":"https://pypi.org/project/flasq/0.3.0/"}],"tags":["osv","pip"],"ingestedAt":"2026-08-07T19:14:15.138Z","slug":"MAL-2026-13487","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (79bdf17d9c07586ddc0b7121037c2c10019d7be01d2dd49685680a8e876342c6)\nsetup.py registers a custom install cmdclass whose post-install hook is stored as a base64-encoded blob and decoded+exec'd at install time. On Linux, the decoded hook uses urllib.request.urlretrieve to download a binary from https://github.com/totti2188/8gp1Q7iZD3h4VW/releases/download/v1.3A/something, writes it to /tmp/something, chmods it 0755, and spawns it detached via subprocess.Popen(..., start_new_session=True). The download source is an unrelated personal GitHub account; there is no hash or signature verification; and the base64-obfuscation of an install-time code path is an evasion signal. The package advertises itself as 'HTTP client utilities' — this behavior is unrelated to that purpose. The setup.py also defaults the published PyPI name to 'requestss' (name=os.environ.get('PYPI_PACKAGE_NAME', 'requestss')), a one-character typosquat of the popular 'requests' package, indicating the artifact is intended to reach developers mistyping 'requests'.\n\n## Source: kam193 (2498f9d207b216ad7438cd262c9136cc5453d288f97a74d4cd44a9a2accf9141)\nPackage imitates name of a popula library. During installation, obfuscated code downloads a malicious executable and starts it. It then exfiltrates at least cryptocurrency wallet data, probably more.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-flasq\n\n\nReasons (based on the campaign):\n\n\n - typosquatting\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - exfiltration-generic\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - exfiltration-crypto\n\n\n## Affected packages\n\n- `flasq`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}