🛡️ MAL-2026-2138 — open-vp-cal

Malicious code in open-vp-cal (PyPI)

Source: kam193

When executing the module, the code installs a package from a remote location. The remote package contains malicious code exfiltrating selected env variables and selected information from credential files. The code claims to be security research.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-03-open-vp-cal

Reasons (based on the campaign):

• exfiltration-env-variables
• Downloads and executes a remote malicious script.
• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.