MAL-2026-14587
Malicious code in pygame-renderkit (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: kam193 (5856daeb3070a9b2a6ffc42d8999ff49c63706ccb27ee683e5fcc4ff175f78f9) During installation, the package attempts to exfiltrate sensitive environment variables and files, establish persistence and open reverse shell.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-pygame-renderkit
Reasons (based on the campaign):
- persistence
- The package overrides the install command in setup.py to execute malicious code during installation.
- The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.
- files-exfiltration
- exfiltration-env-variables
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for pygame-renderkit (pip). Pin to a known-safe version or switch to an alternative.