---
id: MAL-2026-16016
title: Malicious code in cv-train (PyPI)
summary: Malicious code in cv-train (PyPI)
severity: critical
exploited: true
vendor: cv-train
product: cv-train
ecosystem: pip
affected:
  - cv-train
published: '2026-09-07'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:45:08.737601131Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-16016'
references:
  - url: 'https://bad-packages.kam193.eu/pypi/package/cv-train'
  - url: 'https://pypi.org/project/cv-train/0.0.5/'
tags:
  - osv
  - pip
  - malware
ingestedAt: '2026-09-08T15:41:10.935Z'
---

## Overview


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (3e63e889d2bfc807902ef5bcd86b6d65b95272587726dda61e4efb63d461fc3b)
setup.py defines a phone_home() function invoked at module top level, so it runs during `pip install`. The function collects the machine hostname, username, current working directory, and the path of any discovered pip.conf, then transmits these values to a hardcoded webhook.site callback via both a DNS lookup and a plaintext HTTP GET to http://webhook.site/2271fec9-1e0d-4a8c-a1c9-b5b0cb9d2b04/cv-train?pkg=...&host=...&user=...&cwd=...&pip_conf=.... The shipped Python module itself is an empty stub; the package's metadata and print statements advertise it as a dependency-confusion proof of concept targeting the name 'cv-train', so any environment with an internal package of that name and a misconfigured index resolution would install this beacon in place of the intended dependency.

## Source: kam193 (291eeeae57d4bc439348ef96b08581d69e1160508cc156acfcd8d74b94ead981)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.


---

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.


Campaign: GENERIC-standard-pypi-install-pentest


Reasons (based on the campaign):


 - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.


 - The package overrides the install command in setup.py to execute malicious code during installation.


## Affected packages

- `cv-train`

## Remediation

Refer to the advisory for the patched release.