{"id":"MAL-2026-5768","title":"Malicious code in bash8 (PyPI)","summary":"Malicious code in bash8 (PyPI)","severity":"none","vendor":"bash8","product":"bash8","ecosystem":"pip","affected":["bash8"],"published":"2026-06-14","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-5768","references":[{"url":"https://bad-packages.kam193.eu/pypi/package/bash8"},{"url":"https://pypi.org/project/bash8/1.0.0/"},{"url":"https://pypi.org/project/bash8/0.0.0/"}],"tags":["osv","pip"],"ingestedAt":"2026-07-08T18:25:54.773Z","slug":"MAL-2026-5768","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e665213ba552605420b2269888e041b8b8af4c9e8314d731a8aa246f0fefd748)\nPackage is published as 'bash8' (matching an existing PyPI bash linter) but installs a top-level module named 'ca_certificates' whose only content is a stub `__version__ = \"0.0.0\"` and an `info()` function returning the string 'This is a dummy bash8 package for PyPI.' Author metadata is the placeholder 'Your Name <you@example.com>'. The package contains no install hooks, no network I/O, no subprocess execution, and no credential reads — it is functionally inert. The installable module name 'ca_certificates' would shadow imports of that identifier in any environment where this package is installed, and the distribution name collides with an existing linter. Name confusion alone, without an installer-harm payload, is a subjective signal best resolved by a human reviewer.\n\n## Source: kam193 (cc82142b2f705e97dabfd2945e1f4686296211b857a6ccda5195803650bddf63)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n## Affected packages\n\n- `bash8`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}