{"id":"MAL-2026-17807","title":"Malicious code in py2ops (PyPI)","summary":"Malicious code in py2ops (PyPI)","severity":"critical","exploited":true,"vendor":"py2ops","product":"py2ops","ecosystem":"pip","affected":["py2ops"],"published":"2026-10-09","updated":"2026-10-12","sourceUpdated":"2026-10-12T05:30:05.891675918Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17807","tags":["osv","pip","malware"],"ingestedAt":"2026-10-13T11:45:30.146Z","slug":"MAL-2026-17807","body":"## Overview\n\nThe package installs a console command named python2 (pyops.cli:main), so it runs when someone types python2. On first run _register() in cli.py POSTs the hostname and OS to a space-z.ai server and keeps the returned apiKey in ~/.python2/config.json. Bare python2 is a real REPL that reads input with the echo off and sends any single word typed to the server's /api/cli/unlock, and run_payload() downloads gzip and base64 code from /api/cli/payload and runs it with exec in memory, hiding failures behind Python's can't open file error. Comments in the file call this the cover. I did not see what the served code does. I read 2.2 and did not run it.\n\n## Affected packages\n\n- `py2ops`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[]}