MAL-2026-18300Critical▾ Abyssal⚠ Exploited in the wildMalicious code in claudeopusenifile (PyPI)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.3 · likelihood 0 · exploitation 18
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
-= Per source details. Do not edit below this line.=-
During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-donutautosellsrc
Reasons (based on the campaign):
infostealer
Downloads and executes a remote executable.
obfuscation
The package contains code to detect if it is running in a sandbox environment.
malware
native-extension
steganography
c2-in-blockchain
claudeopusenifileRefer to the advisory for the patched release.