---
id: MAL-2026-17862
title: Malicious code in fontcase (PyPI)
summary: Malicious code in fontcase (PyPI)
severity: critical
exploited: true
vendor: fontcase
product: fontcase
ecosystem: pip
affected:
  - fontcase
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:30:03.055532383Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-17862'
references:
  - url: >-
      https://www.virustotal.com/gui/file/08c3367965ba26fd0c2ed4ecac2fe831cf8fe517af59ce6947ae18b4fa30e20f/detection
  - url: 'https://tria.ge/261013-x3rflayz4j'
  - url: 'https://bad-packages.kam193.eu/pypi/package/fontcase'
tags:
  - osv
  - pip
  - malware
ingestedAt: '2026-10-15T11:47:08.220Z'
---

## Overview


---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (9e2c4992e5295f2b094f3c7c2b2e6c2dbc8d0d9ca6242d58318e6e1b83a4255c)
During import, the package downloads and executes an infostealer.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-10-fontcase


Reasons (based on the campaign):


 - infostealer


 - Downloads and executes a remote executable.


 - uses-telegram-bot


 - exfiltration-browser-data


 - exfiltration-credentials


## Affected packages

- `fontcase`

## Remediation

Refer to the advisory for the patched release.