Malicious code in index-forum (PyPI)
MAL-2026-16268
Published · Modified
Dependency scanning
Check whether index-forum is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
__
Source: amazon-inspector (4b837b7b56f9b239c9d0c86bd2e7d432d3223e496a9820c54b0a14fd3c542b22)
The package was found to contain malicious code or consuming dependency that contains malicious code
Source: kam193 (7561fd94425cdde34f5f9f3d20482a0da8680414d0f38e1e00fea419ce23cf66)
The package hides code to exfiltrate specific files from the user's machine. The used file paths suggest it was intended to be used in a CTF-like environment.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-pyjstat-smooth
Reasons (based on the campaign):
files-exfiltration
obfuscation
targetted-attack
clones-real-package
Ready to move
Start Securing
Free, no credit card | First findings in minutes