Critical Malware Feed Entry Detected 2026-08-20
Malware feed entry — detected by codelake scanners. This package was flagged malicious by our own detection pipeline. See the rules that fired and the package identifiers below. Full analysis, timeline and IOCs live on hand-curated advisories at /advisories; this page is the machine-generated receipt for the live feed.
Detection details
[email protected] published to pypi, flagged by codelake scanners on 2026-08-20 09:41 UTC.
Detector rules that fired on this package:
- Source decodes a payload (base64/hex/zlib) and exec/eval's it in the same file — dropper pattern
behavior.pystatic.decode-and-exec - Source calls exec()/eval() — dynamic code execution
behavior.pystatic.exec-eval - File has high Shannon entropy — likely obfuscated / packed / encrypted payload
behavior.pystatic.high-entropy - Source contains a long base64 string literal — possible embedded payload
behavior.pystatic.long-base64 - setup.py overrides an install/build command via cmdclass — runs custom code at install time
behavior.pystatic.setup-cmdclass-override - Package name 'flasq' is one edit from popular package 'flask' — possible typosquat
behavior.typosquat.near-popular-name - Assembled Python string (decode, 1 fragments) reconstructs to "import os, platform, subprocess, tempfile, urllib.request\n)f platform.system() == \"Linux\":\n t = os.path.join(tempfile…" — deobfuscated-code; fed to a dynamic-execution sink
mosaic.assembled-deobfuscated-code
OSV reference: MAL-2026-13487
This is an auto-generated entry in the codelake malware feed. Hand-curated deep case studies live on /advisories.