MAL-2026-16128
Malicious code in pymem-win (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: kam193 (82eb1f11c9b56a2f2c3e97530db43ef94784a2c75697223828403927b0528477) During import, the obfuscated code downloads and executes an executable. The remote executable did not exist during analysis, but the repository used to host it overlaps with previous campaign 2026-07-yt-api-dlp
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-pymem-win
Reasons (based on the campaign):
- obfuscation
- Downloads and executes a remote executable.
- clones-real-package
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for pymem-win (pip). Pin to a known-safe version or switch to an alternative.