{"id":"MAL-2026-14488","title":"Malicious code in python-walletlibr-v (PyPI)","summary":"Malicious code in python-walletlibr-v (PyPI)","severity":"none","vendor":"python-walletlibr-v","product":"python-walletlibr-v","ecosystem":"pip","affected":["python-walletlibr-v"],"published":"2026-08-25","updated":"2026-08-25","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-14488","references":[{"url":"https://pypi.org/project/python-walletlibr-v/0.7.9/"}],"tags":["osv","pip"],"ingestedAt":"2026-08-26T19:27:01.664Z","slug":"MAL-2026-14488","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c)\npython-walletlibr-v is a wallet-lookalike PyPI package that ships no wallet functionality — only a stub hello() that prints 'Hello from my custom library!' and placeholder author metadata (__author__ = 'Your Name'). Its setup.py registers a CustomInstall command that, on Windows at pip install time, writes a.bat file into %TEMP%, spawns a new cmd.exe console to execute it via subprocess.Popen(['cmd.exe','/k', bat_path], CREATE_NEW_CONSOLE), and calls os.system('calc'). Arbitrary local command execution fires automatically during pip install on Windows hosts, unrelated to any advertised functionality.\n\n\n## Affected packages\n\n- `python-walletlibr-v`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}