CERT24MAL-2026-18218 — Malicious code in qowa (PyPI)
The PyPI package qowa contains malicious code. It obtains the installer's hostname and transmits it through hardcoded Telegram Bot API endpoints to a channel controlled by a third party. The package also contains a C2 server and agent, as well as code to execute remote commands on the victim's machine.