MAL-2026-17807Critical▾ Abyssal⚠ Exploited in the wildMalicious code in py2ops (PyPI)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.3 · likelihood 0 · exploitation 18
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
The package installs a console command named python2 (pyops.cli:main), so it runs when someone types python2. On first run _register() in cli.py POSTs the hostname and OS to a space-z.ai server and keeps the returned apiKey in ~/.python2/config.json. Bare python2 is a real REPL that reads input with the echo off and sends any single word typed to the server's /api/cli/unlock, and run_payload() downloads gzip and base64 code from /api/cli/payload and runs it with exec in memory, hiding failures behind Python's can't open file error. Comments in the file call this the cover. I did not see what the served code does. I read 2.2 and did not run it.
py2opsRefer to the advisory for the patched release.