Hostile ^100% python Download

my-private-pkg 99.11.2

Exfiltrates system info on install

“A private Python package”

PyPI package posts caller data to an OOB endpoint at runtimeInstall class beacons a host profile

SHA-256ab03f9c073ed600be1948f875cddae411974aaf2b3870d6b58b27509331475bb

URLhttps://files.pythonhosted.org/packages/be/13/6c3a5a3a72f7bf361c77ccb0ef247a25de7b68006fa15f0d724dfb20c135/my_private_pkg-99.11.2.tar.gz

MaleculeO₃(Eu₄S₉Dy₂)H₅(Cm₁₁DbFOs₃Po)Md₅(Bk₂In₄Pa₅Pt)

Also flagged by osm (setup.py registers a custom install command (PostInstallCommand) that runs my_private_pkg/index.py automatically on `pip install`. That script gathers installer-side identifiers — os.getlogin(), soc…), osv (MAL-2026-17180: Malicious code in my-private-pkg (PyPI)) +3 more.

my-private-pkg 99.11.2

Evidence