---
id: MAL-2026-6758
title: Malicious code in httpprobe (PyPI)
summary: Malicious code in httpprobe (PyPI)
severity: none
vendor: httpprobe
product: httpprobe
ecosystem: pip
affected:
  - httpprobe
published: '2026-07-04'
updated: '2026-07-04'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-6758'
references:
  - url: 'https://bad-packages.kam193.eu/pypi/package/httpprobe'
tags:
  - osv
  - pip
ingestedAt: '2026-07-08T18:25:54.815Z'
---

## Overview


---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (5a1fef079efe68484b2d37fb2e1bb3d0cebfeccf27a8a0f9b1e8436e664ea42e)
If run as a module and during installation, the package attempts to download and start an executable described as a Mirai agent. During analysis, the Onion website hosting executable was not available. Using Onion and localhost fallback suggests the package was not yet ready to deliver malicious actions to the end users.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-07-httpprobe


Reasons (based on the campaign):


 - Downloads and executes a remote executable.


 - The package overrides the install command in setup.py to execute malicious code during installation.


## Affected packages

- `httpprobe`

## Remediation

Refer to the advisory for the patched release.