MAL-2026-17195
Malicious code in claudedashbord (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: kam193 (5a1141a5d4c10d0c58128d6397750ce3fcd2ab16eea32113be3da61d7a16f5a6) During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-donutautosellsrc
Reasons (based on the campaign):
- infostealer
- Downloads and executes a remote executable.
- obfuscation
- malware
- native-extension
- steganography
- c2-in-blockchain
- The package contains code to detect if it is running in a sandbox environment.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for claudedashbord (pip). Pin to a known-safe version or switch to an alternative.