ZeroDay Findings
Sign inSign up

Findings

MAL-2026-17847

Malicious code in npp-ml (PyPI)

Published Oct 12, 2026 · updated Oct 13, 2026

--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (7f575d02caf2363703b49c45c7f5ba106b798ee4f5b02f1977b118f2b52ff30e) The package claims to provide a Notepad++ distribution, but in fact delivers ADExplorer, an Active Directory analysis tool. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-npp-ml Reasons (based on the campaign): - other - impersonation

Timeline

Detection, updates, and resolution for this record.

  1. Oct 12, 2026 · Catalog

    Detected

    --- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (7f575d02caf2363703b49c45c7f5ba106b798ee4f5b02f1977b118f2b52ff30e) The package claims to provide a Notepad++ distribution, but in fact delivers ADExplorer, an Active Directory analysis tool. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-npp-ml Reasons (based on

  2. Oct 13, 2026 · Catalog

    Updated

    --- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (7f575d02caf2363703b49c45c7f5ba106b798ee4f5b02f1977b118f2b52ff30e) The package claims to provide a Notepad++ distribution, but in fact delivers ADExplorer, an Active Directory analysis tool. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-npp-ml Reasons (based on

Affected

  • PyPI npp-ml0.1.7, 0.1.8, 0.1.9

Sources

References