{"id":"MAL-2026-18188","title":"Malicious code in 1h1 (PyPI)","summary":"Malicious code in 1h1 (PyPI)","severity":"critical","exploited":true,"vendor":"1h1","product":"1h1","ecosystem":"pip","affected":["1h1"],"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T23:45:03.530765679Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18188","references":[{"url":"https://www.virustotal.com/gui/file/e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7/"},{"url":"https://bad-packages.kam193.eu/pypi/package/1h1"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-10-23T11:58:17.244Z","slug":"MAL-2026-18188","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (04938e0ebf8781fb6c986fda09db9f4a60c240eb6dc79ab33e6faf7a5589b353)\nDuring installation, package downloads and executes malware.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-semvver\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - malware\n\n\n - typosquatting\n\n\n## Affected packages\n\n- `1h1`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[]}