MAL-2026-15566
Malicious code in flask-header-guard (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: kam193 (d050fa5a7000088c15b40b82ace014d66f18520ff36464659c8ad6e999ee83cb) During installation, the package attempts to exfiltrate sensitive environment variables and files, establish persistence and open a reverse shell. Additionally, the provided Flask middleware embeds a backdoor.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-pygame-renderkit
Reasons (based on the campaign):
- The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.
- files-exfiltration
- The package overrides the install command in setup.py to execute malicious code during installation.
- exfiltration-env-variables
- persistence
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for flask-header-guard (pip). Pin to a known-safe version or switch to an alternative.