{"id":"MAL-2026-15935","title":"Malicious code in proxycer (PyPI)","summary":"Malicious code in proxycer (PyPI)","severity":"critical","exploited":true,"vendor":"proxycer","product":"proxycer","ecosystem":"pip","affected":["proxycer"],"published":"2026-09-05","updated":"2026-09-11","sourceUpdated":"2026-09-11T05:00:08.536330817Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-15935","references":[{"url":"https://bad-packages.kam193.eu/pypi/package/proxycer"},{"url":"https://pypi.org/project/proxycer/0.1.0/"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-09-05T19:33:45.863Z","slug":"MAL-2026-15935","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2286dac5be0a9e8cc2e7b1ff92253d4b09beb0c43d5e795b9b9ea1391e6f8764)\nThe package's top-level __init__.py imports starts.py, which is a single-line loader that reverses a ~100KB string literal, base64-decodes it, marshal.loads the result into a code object, and exec()s it. All actual functionality is concealed behind reversal + base64 + marshal bytecode obfuscation, with an empty README and empty PKG-INFO description. The obfuscated code object runs automatically on `import proxycer`, so any behavior it contains (credential access, outbound network, filesystem writes, persistence) executes on the installer's host without source visibility.\n\n## Source: kam193 (c7f54d8a442ae6b7c359629af5db210aafade4776e03f44895e67923bd464e29)\nThe provided functionality hides code that exfiltrates files to a remote location.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-asti\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - action-hidden-in-lib-usage\n\n\n - target:android\n\n\n\n## Affected packages\n\n- `proxycer`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[{"seq":202655,"id":"MAL-2026-15935","ts":1789400125639,"field":"exploited","old":"false","new":"true"},{"seq":202654,"id":"MAL-2026-15935","ts":1789400125639,"field":"severity","old":"none","new":"critical"},{"seq":201382,"id":"MAL-2026-15935","ts":1789397625611,"field":"exploited","old":"true","new":"false"},{"seq":201381,"id":"MAL-2026-15935","ts":1789397625611,"field":"severity","old":"critical","new":"none"},{"seq":200075,"id":"MAL-2026-15935","ts":1789395588368,"field":"exploited","old":"false","new":"true"},{"seq":200074,"id":"MAL-2026-15935","ts":1789395588368,"field":"severity","old":"none","new":"critical"},{"seq":199312,"id":"MAL-2026-15935","ts":1789392266840,"field":"exploited","old":"true","new":"false"},{"seq":199311,"id":"MAL-2026-15935","ts":1789392266840,"field":"severity","old":"critical","new":"none"},{"seq":197645,"id":"MAL-2026-15935","ts":1789384308310,"field":"exploited","old":"false","new":"true"},{"seq":197644,"id":"MAL-2026-15935","ts":1789384308310,"field":"severity","old":"none","new":"critical"},{"seq":196919,"id":"MAL-2026-15935","ts":1789383784916,"field":"exploited","old":"true","new":"false"},{"seq":196918,"id":"MAL-2026-15935","ts":1789383784916,"field":"severity","old":"critical","new":"none"},{"seq":195823,"id":"MAL-2026-15935","ts":1789380596301,"field":"exploited","old":"false","new":"true"},{"seq":195822,"id":"MAL-2026-15935","ts":1789380596301,"field":"severity","old":"none","new":"critical"},{"seq":194774,"id":"MAL-2026-15935","ts":1789378794330,"field":"exploited","old":"true","new":"false"},{"seq":194773,"id":"MAL-2026-15935","ts":1789378794330,"field":"severity","old":"critical","new":"none"},{"seq":193561,"id":"MAL-2026-15935","ts":1789376561427,"field":"exploited","old":"false","new":"true"},{"seq":193560,"id":"MAL-2026-15935","ts":1789376561427,"field":"severity","old":"none","new":"critical"},{"seq":192348,"id":"MAL-2026-15935","ts":1789373645194,"field":"exploited","old":"true","new":"false"},{"seq":192347,"id":"MAL-2026-15935","ts":1789373645194,"field":"severity","old":"critical","new":"none"},{"seq":191133,"id":"MAL-2026-15935","ts":1789369518240,"field":"exploited","old":"false","new":"true"},{"seq":191132,"id":"MAL-2026-15935","ts":1789369518240,"field":"severity","old":"none","new":"critical"},{"seq":189920,"id":"MAL-2026-15935","ts":1789368466192,"field":"exploited","old":"true","new":"false"},{"seq":189919,"id":"MAL-2026-15935","ts":1789368466192,"field":"severity","old":"critical","new":"none"},{"seq":188703,"id":"MAL-2026-15935","ts":1789365252184,"field":"exploited","old":"false","new":"true"},{"seq":188702,"id":"MAL-2026-15935","ts":1789365252184,"field":"severity","old":"none","new":"critical"},{"seq":187490,"id":"MAL-2026-15935","ts":1789363481974,"field":"exploited","old":"true","new":"false"},{"seq":187489,"id":"MAL-2026-15935","ts":1789363481974,"field":"severity","old":"critical","new":"none"},{"seq":186276,"id":"MAL-2026-15935","ts":1789361250344,"field":"exploited","old":"false","new":"true"},{"seq":186275,"id":"MAL-2026-15935","ts":1789361250344,"field":"severity","old":"none","new":"critical"},{"seq":185063,"id":"MAL-2026-15935","ts":1789358408207,"field":"exploited","old":"true","new":"false"},{"seq":185062,"id":"MAL-2026-15935","ts":1789358408207,"field":"severity","old":"critical","new":"none"},{"seq":183312,"id":"MAL-2026-15935","ts":1789354334548,"field":"exploited","old":"false","new":"true"},{"seq":183311,"id":"MAL-2026-15935","ts":1789354334548,"field":"severity","old":"none","new":"critical"},{"seq":182105,"id":"MAL-2026-15935","ts":1789353337000,"field":"exploited","old":"true","new":"false"},{"seq":182104,"id":"MAL-2026-15935","ts":1789353337000,"field":"severity","old":"critical","new":"none"},{"seq":180898,"id":"MAL-2026-15935","ts":1789350308748,"field":"exploited","old":"false","new":"true"},{"seq":180897,"id":"MAL-2026-15935","ts":1789350308748,"field":"severity","old":"none","new":"critical"},{"seq":179691,"id":"MAL-2026-15935","ts":1789348312931,"field":"exploited","old":"true","new":"false"},{"seq":179690,"id":"MAL-2026-15935","ts":1789348312931,"field":"severity","old":"critical","new":"none"},{"seq":178484,"id":"MAL-2026-15935","ts":1789346387823,"field":"exploited","old":"false","new":"true"},{"seq":178483,"id":"MAL-2026-15935","ts":1789346387823,"field":"severity","old":"none","new":"critical"},{"seq":177277,"id":"MAL-2026-15935","ts":1789343192822,"field":"exploited","old":"true","new":"false"},{"seq":177276,"id":"MAL-2026-15935","ts":1789343192822,"field":"severity","old":"critical","new":"none"},{"seq":175394,"id":"MAL-2026-15935","ts":1789334899865,"field":"exploited","old":"false","new":"true"},{"seq":175393,"id":"MAL-2026-15935","ts":1789334899865,"field":"severity","old":"none","new":"critical"},{"seq":174189,"id":"MAL-2026-15935","ts":1789333720611,"field":"exploited","old":"true","new":"false"},{"seq":174188,"id":"MAL-2026-15935","ts":1789333720611,"field":"severity","old":"critical","new":"none"},{"seq":173003,"id":"MAL-2026-15935","ts":1789331109301,"field":"exploited","old":"false","new":"true"},{"seq":173002,"id":"MAL-2026-15935","ts":1789331109301,"field":"severity","old":"none","new":"critical"}]}