A PyPI package named extrahtml has been compromised with malicious code. The code, embedded in a YAML loader, executes remote code from a provided file. The attackers intentionally included the malicious code in the package, which is then downloaded and executed, potentially leading to infostealer malware. This vulnerability affects organizations that rely on the extrahtml package, and developers should update to a secure version to prevent exploitation.

A vulnerability (OSV:MAL-2026-18772) was discovered in the PyPI package parseyaml, where malicious code is embedded in a dependency that pretends to be a YAML loader. This code executes remote code by downloading and running a malicious script from a provided file. The campaign has malicious intent, similar to infostealers. This vulnerability matters to people building or operating AI agents because it highlights the need for secure dependency management and code review, as an attacker can exploit this vulnerability to inject malicious code into their systems through a seemingly innocuous dependency.

A new malicious code item has been identified as MAL-2026-18770 in the bundyfed package on PyPI. This vulnerability allows an attacker to download and execute a malicious executable that contains an infostealer during package installation. The malicious code overrides the install command in setup.py, indicating a malicious intent to steal sensitive information. This matters to people building and operating AI agents as it highlights the importance of verifying the integrity and trustworthiness of dependencies and packages used in development and deployment.

A malicious RubyGem was discovered to contain a native extension script that executes during installation, collecting sensitive host data without user consent. The script gathers details such as the current working directory, hostname, login name, and files from /etc/resolv.conf, /etc/passwd, and /etc/hosts. The collected data is then transmitted to a hardcoded server via HTTPS, with a DNS lookup also being performed to an attacker-controlled domain. This malicious activity is unrelated to the declared publisher or build dependencies, indicating a potential security risk for users installing the affected RubyGem.

A RubyGem named dynamic-object-handler has been identified as containing malicious code. The gem, when installed, automatically executes a script that collects sensitive information from the system, including the current working directory, home directory, hostname, login name, and contents of certain system files. This information is then transmitted to a hardcoded Burp Collaborator subdomain, indicating unauthorized code execution on the system. The discovery highlights the importance of scrutinizing dependencies and verifying their integrity to prevent potential security breaches.

A malicious code vulnerability, identified as MAL-2026-18765, has been found in the donjon-ledger RubyGem. The issue arises from the gemspec declaring ext/mkrfconf.rb as a native extension, which executes automatically during installation. This allows the malicious code to collect host identifiers and sensitive system data, including the hostname, username, and contents of /etc/passwd, /etc/hosts, and /etc/resolv.conf. The code then sends this data to a hardcoded Burp Collaborator subdomain via a TLS connection, performing a DNS lookup to the same subdomain. This vulnerability presents a risk to users who install the affected gem, potentially allowing unauthorized data exfiltration.

A Python package named blender-headless on PyPI contains malicious code that leaks an installer's hostname and install/import event via DNS queries. The package's setup.py and gcplogpoc/init.py modules construct a DNS label with the installer's hostname and import event, and send it to a domain controlled by the attacker. This allows the attacker to bypass typical HTTP egress controls and potentially monitor or exploit the installation. The package has no legitimate functionality and appears to be a beacon for malicious activity.

A malicious package named infra-libs has been discovered on PyPI, a package repository. The package performs DNS exfiltration during installation, sending the installer's hostname to an unauthorized domain testa213022.dssldrf.net. This behavior is not justified by the package's declared functionality and is likely a dependency-confusion attack vector. Development teams should be cautious when using this package and consider replacing it with a trusted alternative.

A vulnerability (MAL-2026-18760) was discovered in the "expect-tests" package on the Python Package Index (PyPI). The issue is caused by the package's setup.py and gcplogpoc/init.py files reading the installer's hostname and encoding it into a subdomain of a suspicious domain, testa213022.dssldrf.net, which triggers DNS resolution and exfiltrates the hostname to a non-first-party DNS server. This occurs during installation and module import, potentially compromising the installer's hostname. The package's behavior is undisclosed, and its name and version (99.99.99) are inconsistent with its imported module name gcplogpoc, indicating a potential dependency-confusion or name-squatting attack.

A vulnerability was discovered in the chromacli package on PyPI. The package, which is a terminal color library, contains malicious code that downloads and executes an unsigned executable from an anonymous file-sharing host when run on Windows systems. The code bypasses Microsoft Defender detection by excluding the executable from real-time scanning. The malicious payload is an infostealer, which has clearly malicious intent. This vulnerability affects users who install the chromacli package, particularly on Windows systems.

A malicious package named gcp-log-poc has been identified on PyPI, a Python package repository. The package contains code that exfiltrates sensitive environment information, including IP addresses and usernames, when imported. This poses a risk to developers who use the package, potentially allowing attackers to steal sensitive data.