Malicious code in urc (PyPI)
MAL-2026-16298
Published · Modified
Dependency scanning
Check whether urc is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
__
Source: kam193 (abbaafd909f0cd09835c29c401432a9aa6094c2007973ba23e70f3fe06b07785)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: GENERIC-standard-pypi-install-pentest
Reasons (based on the campaign):
The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
The package overrides the install command in setup.py to execute malicious code during installation.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes