MAL-2026-16131Critical▾ Abyssal⚠ Exploited in the wildMalicious code in aitextutils-py (PyPI)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.3 · likelihood 0 · exploitation 18
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
-= Per source details. Do not edit below this line.=-
The package was found to contain malicious code or consuming dependency that contains malicious code
This package executes code from malicious dependency, which hides code downloading script, which then downloads and executes a heavily obfuscated final stage. The remote stages are hosted on a domain presenting a suspicious-looking corporate website. The downloaded code establishes persistence e.g. as "anymeetly-cameradriver" systemd service.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-aitextkit-py
Reasons (based on the campaign):
obfuscation
Downloads and executes a remote malicious script.
persistence
infostealer
exfiltration-browser-data
rat
The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
aitextutils-pyRefer to the advisory for the patched release.