Malicious code in getpubip (PyPI)

{
  "id": "7ade26eb5f548ce626034725fdc4a9dd0d000afa8e5512b8c75a12eb7d942f6d",
  "url": "https://osv.dev/vulnerability/MAL-2026-17884",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in getpubip (PyPI)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6d316a35a6fe335032b2c59e47627c0af28bec9688cba40585f1365cab4f4452) getpubip/__init__.py runs exec() on an approximately 2KB opaque payload produced by reversing a string literal, base64-decoding it, and zlib-decompressing it (lambda __: __import__('zlib').decompress(__import__('base64').b64decode(__[::-1])); exec(_(b'...'))). The package advertises itself as a three-line helper that returns the host's public IP by calling ipify, and a clean implementation of that functionality exists in core.py; __init__.py does not re-export get_ip and its only effect on import is to execute the hidden blob. The payload is reached whenever a consumer runs `import getpubip` or `python -m getpubip`, so any installer that uses the package executes the concealed code with no further user action. The triple-layered obfuscation (string reverse, base64, zlib) and single-character identifiers are deliberately chosen to hide the executed code from reviewers; whatever the decoded bytes do runs in the installer's process on first import. ## Source: kam193 (6a07d6dd387bbd88252ffdda7f8c10daf988f0622250daf20e7ec8ee0f63c6d5) During import, obfuscated code downloads and executes an infostealer. Campaign shares some similarities with the campaign 2026-10-fontcase. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-getpubip Reasons (based on the campaign): - Downloads ",
    "evidence": "osv:MAL-2026-17884",
    "products": [
      {
        "name": {
          "value": "getpubip",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "0.1.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.2",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17884",
      "aliases": [
        "MAL-2026-17884"
      ],
      "affected": [
        {
          "package": {
            "name": "getpubip",
            "purl": "pkg:pypi/getpubip",
            "ecosystem": "PyPI"
          },
          "versions": [
            "0.1.0",
            "0.1.1",
            "0.1.2"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/getpubip/MAL-2026-17884.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "getpubip/__init__.py",
                  "tlsh": "35618efeafe46ca7f9610b6dc3418884218749057616b204c9bedbfb577203035c1b17",
                  "sha256": "737351e320abeac2e656790d650c87565aa13e79460552d7162d77b779e42b40"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "md5": "ed3967f1d812ff61faf3d2bd2edea7d4",
                    "sha256": "9b7cbdb0e2de96076ef7f8dfe87012e467b3a84b170e241842149bce8387ef68",
                    "blake2b_256": "609397a624483c8b7321c4a152e20b83e79e184a574bf40d13ea53ef4beb1f7f"
                  },
                  "filename": "getpubip-0.1.1-py3-none-any.whl"
                },
                {
                  "hashes": {
                    "md5": "aaece4ec17b372ae98e65814d0d09538",
                    "sha256": "92288e33cce14f3318a1741bdae091c53e2e21086f231a9a8cf129a135de112e",
                    "blake2b_256": "f1cf3bba655290fe7f189a171f3fd1e5a31ed7fc6e71b692dbe3444ed2bd20de"
                  },
                  "filename": "getpubip-0.1.1.tar.gz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-26T19:00:41.021251171Z",
      "provider": "osv",
      "references": [
        "https://tria.ge/261015-hppmhsgx51",
        "https://bad-packages.kam193.eu/pypi/package/getpubip",
        "https://pypi.org/project/getpubip/0.1.1/"
      ],
      "provider_metadata": {
        "iocs": {
          "urls": [
            "https://api-bsx.pages.dev/download"
          ],
          "domains": [
            "api-bsx.pages.dev"
          ]
        },
        "malicious-packages-origins": [
          {
            "id": "pypi/2026-10-getpubip/getpubip",
            "sha256": "6a07d6dd387bbd88252ffdda7f8c10daf988f0622250daf20e7ec8ee0f63c6d5",
            "source": "kam193",
            "versions": [
              "0.1.0",
              "0.1.1",
              "0.1.2"
            ],
            "import_time": "2026-10-15T10:43:09.275286028Z",
            "modified_time": "2026-10-15T10:13:20.123974Z"
          },
          {
            "id": "IN-MAL-2026-021819",
            "sha256": "6d316a35a6fe335032b2c59e47627c0af28bec9688cba40585f1365cab4f4452",
            "source": "amazon-inspector",
            "versions": [
              "0.1.1"
            ],
            "import_time": "2026-10-26T18:56:20.850159877Z",
            "modified_time": "2026-10-26T18:37:24Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 457896,
  "published_at": "2026-10-15T10:13:20+00:00"
}