{"id":"MAL-2026-6728","title":"Malicious code in dt-validator (PyPI)","summary":"Malicious code in dt-validator (PyPI)","severity":"none","vendor":"dt-validator","product":"dt-validator","ecosystem":"pip","affected":["dt-validator"],"published":"2026-07-02","updated":"2026-07-02","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-6728","references":[{"url":"https://bad-packages.kam193.eu/pypi/package/dt-validator"}],"tags":["osv","pip"],"ingestedAt":"2026-07-08T18:25:54.786Z","slug":"MAL-2026-6728","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (0fc0256380d811cdce05ffa9c3644a5f7e4ebd6f7acfce0f955935b42449b17a)\nCode contains a function to execute remote code, which at the time of analysis was extracting the \"auth_user\" table from Django DB. The remote code execution is partially documented and disguised with multiple warnings, but a) the 'convenience function' uses a hardcoded endpoint and loads results to the global namespace, b) the warnings are silenced by default.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-06-dt-validator\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - action-hidden-in-lib-usage\n\n\n## Affected packages\n\n- `dt-validator`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}