From 5c841ce7c45d89c6968ab0d59248207ecc515d26 Mon Sep 17 00:00:00 2001
From: saivarun3407 <bhemavarapuvarun@gmail.com>
Date: Sat, 7 Feb 2026 01:30:06 -0600
Subject: [PATCH] Add malware advisory MAL-2026-790 for p7zip-full (PyPI)

---
 .DS_Store                                     | Bin 0 -> 6148 bytes
 advisories/.DS_Store                          | Bin 0 -> 6148 bytes
 advisories/malware/.DS_Store                  | Bin 0 -> 6148 bytes
 advisories/malware/pypi/.DS_Store             | Bin 0 -> 6148 bytes
 .../malware/pypi/p7zip-full/MAL-2026-790.json |  59 ++++++++++++++++++
 5 files changed, 59 insertions(+)
 create mode 100644 .DS_Store
 create mode 100644 advisories/.DS_Store
 create mode 100644 advisories/malware/.DS_Store
 create mode 100644 advisories/malware/pypi/.DS_Store
 create mode 100644 advisories/malware/pypi/p7zip-full/MAL-2026-790.json

diff --git a/.DS_Store b/.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..7f7d071e397a0779e28b2dd24e7b3581c09857be
GIT binary patch
literal 6148
zcmeHK%}T>S5T0$TO)WwW3OxqA7OeFL#Y?F51&ruHr6we3FlI~BHiuHkSzpK}@p+ut
z-HN64;6=pF!0b0WKUwzMus;AGI-_t8zy<&dm9SL9W{FUobU{kSLnzcYGLSHU7$V3P
zvf1$$8KAY>03Sja<GOuWzaY>0K_UZ;zXkmy&W5elyC{__YwK03YSpbf?@{L7&>xPn
zjz74e-lddDFth#ODvt7=y>%wjp&zHwKo!JcgekYzaT?0JBS&eNsaj75teREp*^SBM
zu+?fh2gmJc)0v#K$=*MjPHWco&hF_&?<sjs<%=d%;J>G2)8GtV(O5dSu{TH)nLc2A
zRy(U<WCoZ4W?&T<Fnga>Uxmr?9GL-T;71J5{@|bzx&{l4YU{v;u8$P25R#xxZwW%j
zplh(uh!GT_OA&RcFi#Aj%hB(cJl9~MQI~^IBjb0>$ilo(gc=?Fj!FmNYUGv~U<T$H
zDC@3G=l}Wl@BjHC?lA+*z`tTZRJvZbgHtkR>%!#dtaVWDQAsGT(D+$`hB}HdmyY5F
bsuJ`&WFWc*3ytVO;fsKxfg5JvR~h&KS5Qs-

literal 0
HcmV?d00001

diff --git a/advisories/.DS_Store b/advisories/.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..a42f74228cd8c55bae7ddec24c6e210bd6ecd745
GIT binary patch
literal 6148
zcmeHK%}T>S5Z<-brW7Fug&qT53&#3`;w8lT0!H+pQWFw1m}X0onnNk%tS{t~_&m<+
zZiH$Mo<!^n?0&QJvzz%K`@<OH?kwD6%w&ui&=5H)4T9!I*P0GS<Z=$5Wh@HHd>SMT
z6a7UKetU;an9mYcLjU>wA^^`@FiqmTu<dug)@rYBbc~MCGw!@cQF?`6%yQSyZg6xd
zL=x1xA6&&zIX1V>L|XW98f7ve4kHM;y^hmRl&+YiVJ>q$<uJNNcWn0O^F!MnSO>?$
z#lV`M3{l@dS}eN8_Rj9<#rP?iq~b+U$$@n#n;L6)1?5Xs&t8@$B7Fc)omEE@5(C5l
zF+dEg76bYmFnX(1HdRXu5CcD80QUzA8lt1IQYg0$=<xcC{x%{C==hdEv@|*zD}~?z
z;VKnSrE>km;3^&LmX32YRti-*<8oz~N3UEzUbtKx?3N5?+)+q9F+dC~Gtg2)6VLy1
z_+=U&`O7IZA_j<of5rfBkGzo!Md`EkTX}faTF~yHp<rBv3JB;+mjD>xKGK&?<+o6W
ZI7efp5NAQVOb4WkfFy)EV&E4T_yGA~On?9Y

literal 0
HcmV?d00001

diff --git a/advisories/malware/.DS_Store b/advisories/malware/.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..9d7c3e1688ddf96be90bf5bf1bb57eba722b3e51
GIT binary patch
literal 6148
zcmeHK%}T>S5Z<-XrW7Fug&r5Y7L4@=#Y>3w1&ruHr6#0kFlI}W8l)6*))(?gd>&_Z
zH)63~MeGdBelt5WyV(!2Ka4T%PvRZM9LAUpipbGeAlSVyv|^GGIgSyP`6x<d1pb?e
z{dK@^x7dh1gC<|UKN_V;UbyZ%UujsYYfZapx9ywYUY0=-7L(i$$5-f`OPNNs9Yz<)
zupBrWCo(I-BpZ%ZK@txk<@z$oVp;lflEt~I4RpY6*{y-onNIgzw=4Dzd$X>X9`(@P
zJ($f}_U6|1@!8-Zeaz&GCX@r;O4be5@CwG~dY*!Dmdfl7`s(~TkB}H328aP-V0jrZ
zXM){cUJ7XC!~iky0|U4}2v9`NV5L!Q9nj$Q8RHfr3fTCTKokZ&gOx^zfN)(3s7twd
zVsKp!{lesV1}lxaoN+ZXjALf5A1_?Z4*f!<Gwx}mmKY!g<{4;c*TM7u6n>e7kNo)(
z@`wRq;GZ$Tt$xt=VNvF6{kA+jYX#^nC<^9PXn=q{cL@Lo_mPeY>bO7~@;rl;MjQqE
RRXHGC1Qa3E5Cgx!zz2`)N__wT

literal 0
HcmV?d00001

diff --git a/advisories/malware/pypi/.DS_Store b/advisories/malware/pypi/.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..d0ed0823c8883d5813c8f703ff9af72e8ab432f1
GIT binary patch
literal 6148
zcmeH~%}&BV5XWZ$rIna)(1hbAUNItm$4i6w0@mn34bl{~v33biNhBma>kIiLK94iI
z3yA>_UQCo3GW(nTm~Qr8vfBj!(MZE>fHD9$=)|0h#T=u4@)^t77NXG4=)xx4K?*Vc
z*#3e7^zK%m3kUE55pw$ef?>ZK#45o4_n;d`{XwnvA#(Y`(sI!$Iwj}Ee^5hz&>p1y
zM!R=KwR5H7U=p{3i>NbfmDf&GGH6Fhr>7I5u!BRcFQX(>!-h(eu&;A{)8V*|+bUN^
zqrF<KDt8a-<Ek7T)hXWDACFyUePiqRto0Z_CF<1(EbzalZPjvuHw@;k?b+`ou}bc-
zf08@NVX^|O04uNv3fR5RDJ{Zcd5x?9EAS%)Xn&CCM9(ra)LRD@^!Z5r1tJ;7beAAX
zOV2Vh#2z$ZQjsQA*eixG>DVsqIL|UOH0dDp%=jETv#>W5p=ZZ-sfUB`47p?lSb?t!
z<W03q=l|*V_y4a+Tw?`Tfq$idC^Y?M1D9ma)|ti8Su4?R(aC6BW;jj3Kp(|8mX6{I
bx;AW=6d*mz%n)19_(MR;zy&Mts|tJq0*g%f

literal 0
HcmV?d00001

diff --git a/advisories/malware/pypi/p7zip-full/MAL-2026-790.json b/advisories/malware/pypi/p7zip-full/MAL-2026-790.json
new file mode 100644
index 0000000000000..c20b4543533a1
--- /dev/null
+++ b/advisories/malware/pypi/p7zip-full/MAL-2026-790.json
@@ -0,0 +1,59 @@
+{
+  "id": "MAL-2026-790",
+  "summary": "Malicious code in p7zip-full (PyPI)",
+  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (af6725a21a64c36ce8e101fd062bb45cb87fdb8cb62df47538390c6c1fc4323c)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n",
+  "modified": "2026-02-06T10:29:40.316315Z",
+  "published": "2026-02-06T09:30:38Z",
+  "database_specific": {
+    "malicious-packages-origins": [
+      {
+        "id": "pypi/GENERIC-standard-pypi-install-pentest/p7zip-full",
+        "source": "kam193",
+        "sha256": "af6725a21a64c36ce8e101fd062bb45cb87fdb8cb62df47538390c6c1fc4323c",
+        "versions": [
+          "0.1.0",
+          "0.2.0",
+          "1.0.0",
+          "2.0.0"
+        ],
+        "modified_time": "2026-02-06T09:30:38.598924Z",
+        "import_time": "2026-02-06T10:18:16.426835331Z"
+      }
+    ]
+  },
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://bad-packages.kam193.eu/pypi/package/p7zip-full"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "name": "p7zip-full",
+        "ecosystem": "PyPI",
+        "purl": "pkg:pypi/p7zip-full"
+      },
+      "versions": [
+        "0.1.0",
+        "0.2.0",
+        "1.0.0",
+        "2.0.0"
+      ],
+      "database_specific": {
+        "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/p7zip-full/MAL-2026-790.json"
+      }
+    }
+  ],
+  "schema_version": "1.7.3",
+  "credits": [
+    {
+      "name": "Kamil Mańkowski (kam193)",
+      "contact": [
+        "https://github.com/kam193",
+        "https://bad-packages.kam193.eu/"
+      ],
+      "type": "ANALYST"
+    }
+  ]
+}
\ No newline at end of file