🛡️ MAL-2026-3371 — pycacheopt

Malicious code in pycacheopt (PyPI)

Source: kam193

The extension module hides code that in specific circumstances executes given code. The malicious action is hidden only in the extension module with the same-named Python code file containing only benign code.

This campaign was first detected by Aikido Security.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-pycacheopt

Reasons (based on the campaign):

• other
• The package contains code to detect if it is running in a sandbox environment.