netweavex

{"schema_version":"1.7.4","id":"MAL-2026-18328","published":"2026-10-26T09:58:20Z","modified":"2026-10-29T14:16:01.306771634Z","summary":"Malicious code in netweavex (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3818fe7f3387637c23d6bc51d62f8fd64dc981c82167750cd3059eec73d2849c)\nnetweavex is a typosquat of the popular NetworkX library, reusing its public API, module layout, and README examples (including the `import netweavex as nx` idiom) under a lookalike name. On `import netweavex`, the top-level __init__.py loads netweavex.netweavex, whose module scope invokes exec() on a payload produced by reversing a string literal, base64-decoding it, and zlib-decompressing it (the decoded header is a valid zlib stream, `x\\xda...`). This causes attacker-controlled, opaque bytecode to run on the installer's host at import time. A graph library has no legitimate reason to layer reverse+base64+zlib obfuscation around an exec() sink; the combination of lookalike name, API cloning, and import-time execution of hidden code is the canonical PyPI typosquat dropper shape.\n\n## Source: kam193 (96ae0ec579e95e33c63930792ee782e6229f77547efac35c3894a7e05c8af2ca)\nClone of a legitimated package. During import package executes obfuscated code that downloads code from a GitHub repository. During analysis, the code was just a placeholder.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-netweavex\n\n\nReasons (based on the campaign):\n\n\n - clones-real-package\n\n\n - obfuscation\n\n\n - Downloads and executes a remote malicious script.\n\n\n - typosquatting\n","affected":[{"package":{"name":"netweavex","ecosystem":"PyPI"},"versions":["1.1.0","1.1.1","1.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"netweavex/netweavex.py","sha256":"0dc186f11e0556daca886a9ba16fab7f1dfdff3fbf7400cb7e0f700878da7f3a","tlsh":"ae310aea1de0be32e18ea66b5c5a54e2c28d7768604d26b570edd5e8c4b0a012c4fce1"},{"path":"README.md","sha256":"8a1869b14731ddb7bbf40623f4e3f32371ccdff4a812de1f715fcb9143513fe6","tlsh":"10417737d29a9f3517c002524d5a6d4eea12dae98f971d8dc37c20f1b20a690443a62b"}],"package_integrity":[{"filename":"netweavex-1.1.2-py3-none-any.whl","hashes":{"blake2b_256":"302c1e7a95d0cc2da91d51e2f38bf9c2624b4109ce5bb1a3404df39b5199a127","md5":"7a54ea1f6956edae8e0490d8d3c3a7b1","sha256":"ddc8043036875be0fffdfbf8302f1a77519554a0b07aae0d093cd0418b683026"}},{"filename":"netweavex-1.1.2.tar.gz","hashes":{"blake2b_256":"edec2b6068dfcbd43f7ba6f0a08d48106aa6ebda7f2230e30ca20d71c762bfcd","md5":"54f82ab01808a2b38721a198b3d85131","sha256":"5d84d4e4da39bf25cd67f4593ac3e2c4ef2ea3733e6f203cb705a9c2f77a0599"}}]}}}],"references":[{"type":"WEB","url":"https://github.com/jerryjohnston91/helper-library"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/netweavex"},{"type":"PACKAGE","url":"https://pypi.org/project/netweavex/1.1.2/"},{"type":"PACKAGE","url":"https://pypi.org/project/netweavex/1.1.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/netweavex/1.1.0/"}],"database_specific":{"iocs":{"urls":["https://api.github.com/repos/jerryjohnston91/helper-library/zipball/main","https://codeload.github.com/jerryjohnston91/helper-library/legacy.zip/refs/heads/main"]},"malicious-packages-origins":[{"id":"pypi/2026-10-netweavex/netweavex","import_time":"2026-10-26T10:20:58.157000915Z","modified_time":"2026-10-26T09:58:20.213763Z","sha256":"96ae0ec579e95e33c63930792ee782e6229f77547efac35c3894a7e05c8af2ca","source":"kam193","versions":["1.1.0","1.1.1","1.1.2"]},{"id":"IN-MAL-2026-021807","import_time":"2026-10-26T18:56:19.851724731Z","modified_time":"2026-10-26T18:36:00Z","sha256":"3818fe7f3387637c23d6bc51d62f8fd64dc981c82167750cd3059eec73d2849c","source":"amazon-inspector","versions":["1.1.2"]},{"id":"IN-MAL-2026-022221","import_time":"2026-10-29T14:14:35.451801665Z","modified_time":"2026-10-29T14:04:34Z","sha256":"70ef0c285c109bbc14bff4086bff4af791db693cbe10c0f7ce08b093e35d5b1a","source":"amazon-inspector","versions":["1.1.1"]},{"id":"IN-MAL-2026-022222","import_time":"2026-10-29T14:14:35.521122613Z","modified_time":"2026-10-29T14:04:43Z","sha256":"b34ddd2f6dd62f280d3b14e687eab9adab3ba2578a930346dcff2d965d1090b2","source":"amazon-inspector","versions":["1.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}