Hostile 100% python download unavailable

msrcpoc 99.1.9

Malicious PyPI package, executes commands

PyPI inflated-version package runs identity subprocessPython subprocess queries current account identity
SHA-2561d05260e8c708c392b8218b8ee943b0ef0f016864603e7c85cccbe702413baaa
URLhttps://files.pythonhosted.org/packages/77/84/3de808ce14d399a4576986f35e858479b66deffcd26cbfa95dd488221f63/msrcpoc-99.1.9-py2.py3-none-any.whl
MaleculeO₂(DyS)H₂(DbPo₂)Md(Pa)

Also flagged by osv (MAL-2026-14444: Malicious code in msrcpoc (PyPI)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.