Vulnerabilities

Vulnerability · MAL-2026-17880

Malicious code in seapy-ops (PyPI)

Published Oct 14, 2026 · catalog updated Oct 15, 2026 · Malicious code in seapy-ops

Open the advisory

Exploitation likelihood is not on this record for MAL-2026-17880. A missing EPSS score is not a low risk. Compare Malicious code in seapy-ops with the linked advisory before you change production.

Severity

Unknown—

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Not established

Affected products

PyPI seapy-ops

In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden prompt command also uploads the folder before sending the first prompt. File symlinks can expose content outside that directory. Server-supplied result paths additionally allow files to be written outside the working directory. Versions 1.2.1 and 1.2.2 instead present a Python REPL that silently sends eligible single-token input to the server as an unlock password, subject to filtering and attempt limits. Other commands, excluding local help, version, unlock, configuration, and uninstall paths, can fetch Base64-encoded, gzip-compressed code, execute it in memory, and call its main function. Loader errors are disguised as Python file-not-found errors. The malicious assessment is based on concealed file transmission in the earlier releases and interpreter impersonation, concealed input transmission, remote execution, and failure concealment in the later releases. Official distributions were verified against PyPI digests. Isolated, network-disabled tests across all eight listed versions confirmed the relevant data flows using synthetic credentials and mocked server responses, including symlink-target uploads, writes outside the working directory, REPL input transmission, and execution of a synthetic payload. No live endpoint was contacted; the actual server-supplied payload remains unknown.