{"id":"MAL-2026-17286","title":"Malicious code in queeuees (PyPI)","summary":"Malicious code in queeuees (PyPI)","severity":"critical","exploited":true,"vendor":"queeuees","product":"queeuees","ecosystem":"pip","affected":["queeuees"],"published":"2026-09-29","updated":"2026-09-29","sourceUpdated":"2026-09-29T21:30:08.144067359Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17286","references":[{"url":"https://bad-packages.kam193.eu/pypi/package/queeuees"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-09-30T07:22:02.073Z","slug":"MAL-2026-17286","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (1adc88dd9031dc991006afcf10242d1de3aa7994f6bcb4542faed95524d6ebe0)\nObfuscated code iterates over files in the system and adds a comment to every .py file found.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-queeuees\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - modify-system-without-consent\n\n\n## Affected packages\n\n- `queeuees`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[]}