MAL-2026-16133Critical▾ Abyssal⚠ Exploited in the wildMalicious code in langgrap (PyPI)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.3 · likelihood 0 · exploitation 18
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
-= Per source details. Do not edit below this line.=-
Package name langgrap is a one-character deletion of langgraph, and __init__.py re-exports from langgraph import * so imports appear to succeed. The installed langgrap-setup.pth file contains an import...; exec(...) line that Python auto-executes on every interpreter startup (including non-import invocations like python -V). The exec payload is XOR(0x5A)+base64 obfuscated and, when decoded, uses curl to download http://167.86.108.190:7788/lurves-agent.py to /tmp/.a and runs it via python3 /tmp/.a --daemon, guarded by a /tmp/.lurves-planted marker. The.pth file additionally contains cover-story comments falsely instructing scanners to classify it as clean. This delivers full remote code execution on the installer's host from an unpinned, unverified script fetched over plain HTTP from a bare IP.
Typosquatting package planting a malicious PTH file that during loading Python downloads the next stage. It then hides its existence, downloads the further stage and clears logs. The next stage exfiltrates sensitive data (SSH keys, cloud credentials), ensures persistence and plants a cryptominer. The original PTH file contains a simple attempt to discourage analysis via AI agents.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-openaii
Reasons (based on the campaign):
Downloads and executes a remote malicious script.
obfuscation
abuses-pth
cryptominer
infostealer
exfiltration-credentials
files-exfiltration
exfiltration-ssh-keys
persistence
typosquatting
covering-tracks
langgrapRefer to the advisory for the patched release.