---
id: MAL-2026-14488
title: Malicious code in python-walletlibr-v (PyPI)
summary: Malicious code in python-walletlibr-v (PyPI)
severity: none
vendor: python-walletlibr-v
product: python-walletlibr-v
ecosystem: pip
affected:
  - python-walletlibr-v
published: '2026-08-25'
updated: '2026-08-25'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-14488'
references:
  - url: 'https://pypi.org/project/python-walletlibr-v/0.7.9/'
tags:
  - osv
  - pip
ingestedAt: '2026-08-26T19:27:01.664Z'
---

## Overview


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c)
python-walletlibr-v is a wallet-lookalike PyPI package that ships no wallet functionality — only a stub hello() that prints 'Hello from my custom library!' and placeholder author metadata (__author__ = 'Your Name'). Its setup.py registers a CustomInstall command that, on Windows at pip install time, writes a.bat file into %TEMP%, spawns a new cmd.exe console to execute it via subprocess.Popen(['cmd.exe','/k', bat_path], CREATE_NEW_CONSOLE), and calls os.system('calc'). Arbitrary local command execution fires automatically during pip install on Windows hosts, unrelated to any advertised functionality.


## Affected packages

- `python-walletlibr-v`

## Remediation

Refer to the advisory for the patched release.