MAL-2026-10091
Malicious code in qlinforge (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: kam193 (8952681c2680f17702d34d053b0af1af1ff8e27a18338b3e84cad5de7e661919) During installation, the package downloads and executes suspicious executables as well as establishes persistence using PTH files.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-07-qlinforge
Reasons (based on the campaign):
- The package overrides the install command in setup.py to execute malicious code during installation.
- Downloads and executes a remote executable.
- abuses-pth
- persistence
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for qlinforge (pip). Pin to a known-safe version or switch to an alternative.