---
id: MAL-2026-17847
title: Malicious code in npp-ml (PyPI)
summary: Malicious code in npp-ml (PyPI)
severity: critical
exploited: true
vendor: npp-ml
product: npp-ml
ecosystem: pip
affected:
  - npp-ml
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T21:00:03.324026717Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-17847'
references:
  - url: 'https://bad-packages.kam193.eu/pypi/package/npp-ml'
tags:
  - osv
  - pip
  - malware
ingestedAt: '2026-10-13T11:45:30.147Z'
---

## Overview


---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (7f575d02caf2363703b49c45c7f5ba106b798ee4f5b02f1977b118f2b52ff30e)
The package claims to provide a Notepad++ distribution, but in fact delivers ADExplorer, an Active Directory analysis tool.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-10-npp-ml


Reasons (based on the campaign):


 - other


 - impersonation


## Affected packages

- `npp-ml`

## Remediation

Refer to the advisory for the patched release.