Source: kam193 (044faa804b628c1751f6fa5f66a5f8835ecda1f4d2837ae70411d4630a0607ad)

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-standard-pypi-install-pentest

Reasons (based on the campaign):

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

• The package overrides the install command in setup.py to execute malicious code during installation.

Credit: OpenSSF (source)

References

• https://bad-packages.kam193.eu/pypi/package/dlmm
• https://github.com/ossf/malicious-packages/blob/ffb643191998a2ee07d2d931c519d99a3fa38bf8/osv/malicious/pypi/dlmm/MAL-2026-13728.json
• https://github.com/ossf/malicious-packages/blob/12a61d4a44f29287bbd6ed262153cc170ea4d2b3/osv/malicious/pypi/dlmm/MAL-2026-13728.json
• https://github.com/ossf/malicious-packages/blob/ba888e5d4125c556b874c9e65dabff62cb3855b0/osv/malicious/pypi/dlmm/MAL-2026-13728.json
• https://github.com/ossf/malicious-packages/blob/fb2ad8d0197c933bc993c46833ee4811a5dcdb9e/osv/malicious/pypi/dlmm/MAL-2026-13728.json