MAL-2026-16128Critical▾ Abyssal⚠ Exploited in the wildMalicious code in pymem-win (PyPI)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.3 · likelihood 0 · exploitation 18
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
-= Per source details. Do not edit below this line.=-
Pymem-win is a near-verbatim copy of the legitimate upstream Pymem package (reusing its description, repository URL github.com/srounet/Pymem, and author identity Fabien Reboia [email protected]) republished under a confusable name. The top-level pymem/init.py contains a one-line loader that reverses a bytes literal, base64-decodes it, zlib-decompresses it, and passes the result to exec(). This runs unconditionally on import pymem, handing full in-process code execution to a payload deliberately hidden behind three stacked transforms. The multi-layer obfuscation around an exec target has no legitimate purpose in a library import path; combined with the typosquat cover story that reuses the upstream author's identity, the package's function on install/import is to run attacker-chosen code inside any process that imports it.
During import, the obfuscated code downloads and executes an executable. The remote executable did not exist during analysis, but the repository used to host it overlaps with previous campaign 2026-07-yt-api-dlp
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-pymem-win
Reasons (based on the campaign):
obfuscation
Downloads and executes a remote executable.
clones-real-package
pymem-winRefer to the advisory for the patched release.