MAL-2026-16410
Malicious code in auclean (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: kam193 (c765ad2add74061fa0012c7328f5655ef07dbdf800e6da3802dc0d8de0ad7cea) During installation, the package executes an embedded malicious executable. It then fingerprints the environment and network, looks for specific files, attempts to collect cloud credentials, and eventually attempts to exfiltrate collected information.
The package seems to be targeting the infrastructure of an AI audio competition https://dacon.io/competitions/official/236749
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-auclean
Reasons (based on the campaign):
- files-exfiltration
- The package overrides the install command in setup.py to execute malicious code during installation.
- exfiltration-cloud-tokens
- malware
- exfiltration-credentials
- targetted-attack
- network-scan
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for auclean (pip). Pin to a known-safe version or switch to an alternative.