runpier

{"schema_version":"1.7.4","id":"MAL-2026-18235","published":"2026-10-23T15:58:15Z","modified":"2026-10-29T14:38:27.756707084Z","summary":"Malicious code in runpier (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ecab8a842f7dfacaf3a6294e3dd3c3a1d9c170e1ad119d52f65a94ef431fd262)\nPackage runpier version 0.1.0 on PyPI was scanned across 10 files. No install-time network activity, no subprocess or exec invocations tied to remote content, no reads of installer secret paths (~/.aws, ~/.ssh, ~/.npmrc, ~/.pypirc), no environment-variable scraping, no persistence mechanisms, and no outbound beacons were observed. No credential material, obfuscated payloads, or lifecycle hooks performing network I/O are present.\n\n## Source: kam193 (ab469bbd671fcc96fad392de06c7652a4f9ea899df3c86d285397bfc3985a690)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"runpier","ecosystem":"PyPI"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"runpier-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"b1ce988ac72909538e6636a032d942592465f57ecaf1d5b4326318775628df38","md5":"8cc4bdffd567cdf961c7fdd51d19282e","sha256":"b138c0b32d84af6c132c81fab431c8a05cb0575bd930f295def24b6e352b5888"}},{"filename":"runpier-0.1.0.tar.gz","hashes":{"blake2b_256":"7fb1114f937ae54b16f797d248ac0c2bdc29b7197386e09d7d8c5498bd171fd6","md5":"f8911383ff45d3825b2fd65a913eb6a7","sha256":"6153bda03a510499d2bc845abd827ee491a4fe105f705bad7f1c631738802208"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/runpier"},{"type":"PACKAGE","url":"https://pypi.org/project/runpier/0.1.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/runpier","import_time":"2026-10-23T16:20:13.983836843Z","modified_time":"2026-10-23T15:58:15.898255Z","sha256":"ab469bbd671fcc96fad392de06c7652a4f9ea899df3c86d285397bfc3985a690","source":"kam193","versions":["0.1.0"]},{"id":"IN-MAL-2026-022318","import_time":"2026-10-29T14:37:03.688116927Z","modified_time":"2026-10-29T14:17:15Z","sha256":"ecab8a842f7dfacaf3a6294e3dd3c3a1d9c170e1ad119d52f65a94ef431fd262","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}