MAL-2026-16125Critical▾ Abyssal⚠ Exploited in the wildMalicious code in lucy-python-script-2030 (PyPI)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.3 · likelihood 0 · exploitation 18
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
-= Per source details. Do not edit below this line.=-
The package was found to contain malicious code or consuming dependency that contains malicious code
Starting version 0.1.1, the package contains an infostealer attempting to exfiltrate during import various sensitive data, like browser data, sensitive files, cloud credentials and others. In analyzed versions, the code contained mistakes effectievly disarming the functionality.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-lucy-python-script-2030
Reasons (based on the campaign):
infostealer
exfiltration-browser-data
files-exfiltration
persistence
The package contains code to detect if it is running in a sandbox environment.
uses-telegram-bot
exfiltration-cloud-tokens
lucy-python-script-2030Refer to the advisory for the patched release.