Malicious code in decapod-common (PyPI)

The decapod-common package published on PyPI contained malicious code designed to exfiltrate basic system information from affected hosts. The malicious payload was triggered during package installation or module import.\n\nThe attack vector involved overriding the install command in setup.py to execute the exfiltration code during the installation process. The package had no legitimate functionality beyond this malicious behavior.\n\nThe incident was identified and attributed to the OpenSSF's malicious-packages repository (MAL-2026-13386). The malicious code collected limited host data such as IP addresses and usernames, representing a reconnaissance-level threat.\n\nUsers who installed or imported this package should assume their basic system information was exfiltrated and take appropriate remediation steps.