MAL-2026-16143
Malicious code in chroma-client (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: kam193 (f74658ebb12f3a5cbf8577a768965f3ae81fbe8a156acc843ecffe3dfe2e5153) This package does not carry any malicious payload yet, but uses exactly the same technique as other packages from the campaign aiming to mislead LLM security tools.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-openaii
Reasons (based on the campaign):
- Downloads and executes a remote malicious script.
- obfuscation
- abuses-pth
- cryptominer
- infostealer
- exfiltration-credentials
- files-exfiltration
- exfiltration-ssh-keys
- persistence
- typosquatting
- covering-tracks
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for chroma-client (pip). Pin to a known-safe version or switch to an alternative.