From 127d04135f3766ea00d1f3301476c095017a5535 Mon Sep 17 00:00:00 2001 From: Vulnerability Bot Date: Thu, 12 Nov 2026 07:43:47 +0100 Subject: [PATCH] vuln-osv update 2026-11-12T06:43:41Z --- data/PyPI/MAL-2026-18426.json | 2 +- data/PyPI/MAL-2026-18432.json | 2 +- data/PyPI/MAL-2026-18435.json | 2 +- data/PyPI/MAL-2026-18490.json | 2 +- data/PyPI/MAL-2026-18627.json | 2 +- data/PyPI/MAL-2026-18706.json | 2 +- data/PyPI/MAL-2026-18746.json | 2 +- data/PyPI/MAL-2026-18747.json | 2 +- data/PyPI/MAL-2026-18769.json | 2 +- data/PyPI/MAL-2026-18772.json | 2 +- data/PyPI/MAL-2026-18778.json | 2 +- data/PyPI/MAL-2026-19116.json | 2 +- data/PyPI/MAL-2026-19147.json | 2 +- data/npm/MAL-2026-14420.json | 2 +- data/npm/MAL-2026-18414.json | 2 +- data/npm/MAL-2026-18449.json | 2 +- data/npm/MAL-2026-18798.json | 2 +- data/npm/MAL-2026-18799.json | 2 +- data/npm/MAL-2026-18801.json | 2 +- data/npm/MAL-2026-19148.json | 1 + data/npm/MAL-2026-19149.json | 1 + data/npm/MAL-2026-19150.json | 1 + data/npm/MAL-2026-19151.json | 1 + data/npm/MAL-2026-19152.json | 1 + state/sync.json | 14 +++++++------- 25 files changed, 31 insertions(+), 26 deletions(-) create mode 100644 data/npm/MAL-2026-19148.json create mode 100644 data/npm/MAL-2026-19149.json create mode 100644 data/npm/MAL-2026-19150.json create mode 100644 data/npm/MAL-2026-19151.json create mode 100644 data/npm/MAL-2026-19152.json diff --git a/data/PyPI/MAL-2026-18426.json b/data/PyPI/MAL-2026-18426.json index 242172aa87..79f33985d2 100644 --- a/data/PyPI/MAL-2026-18426.json +++ b/data/PyPI/MAL-2026-18426.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"MAL-2026-18426","published":"2026-10-31T12:48:49Z","modified":"2026-10-31T13:15:04.799227502Z","summary":"Malicious code in is-it-ai (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (6a8580750a7d490d65866e9407c451efa8dbad9a90c35a54b87416c57eef1fea)\nIn this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency (is-it-ai), intentionally pinned by specific versions of dependent packages. All package versions were uploaded with malicious intention; the ones without malicious references are clearly intendent only to hide a cover for the rest. When triggered, the malicious action fingerprints the environment and contacts the remote server. If it responds with an URL, it will be downloaded and executed.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-is-it-ai\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - The malicious code is intentionally included in a dependency of the package\n\n\n - targetted-attack\n\n\n - action-hidden-in-lib-usage\n","affected":[{"package":{"name":"is-it-ai","ecosystem":"PyPI","purl":"pkg:pypi/is-it-ai"},"versions":["0.1.0","0.1.1","0.1.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/is-it-ai/MAL-2026-18426.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/is-it-ai"}],"database_specific":{"iocs":{"domains":["cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app"],"urls":["https://cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app/v1/session/info"]},"malicious-packages-origins":[{"id":"pypi/2026-10-is-it-ai/is-it-ai","import_time":"2026-10-31T13:10:11.833781919Z","modified_time":"2026-10-31T12:48:49.745072Z","sha256":"6a8580750a7d490d65866e9407c451efa8dbad9a90c35a54b87416c57eef1fea","source":"kam193","versions":["0.1.0","0.1.1","0.1.3"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"MAL-2026-18426","published":"2026-10-31T12:48:49Z","modified":"2026-11-12T03:45:03.280269334Z","summary":"Malicious code in is-it-ai (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6c41881d21c4cb046c011c52db3d7725f8d936685710b170f3d4c116032a5158)\nThe package's public verify() function POSTs a JSON payload to the hardcoded endpoint https://cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app/v1/session/info containing OS details, Claude Code / Cursor / Codex environment variables (CLAUDE_PID, CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_MANAGED_SETTINGS_PATH), and a 'thumbprint' built from MD5 hashes of resolved AI-agent marker paths (e.g. /opt/homebrew/bin/claude, CLAUDE.md, MCP gateway.cer files, managed-preferences plists). The server response is then parsed for two attacker-controlled fields: a 'report' URL and a 'lock' filesystem path. _parse_report downloads the URL via urllib.request.urlretrieve, writes the bytes to the server-specified path via os.replace, and executes it — os.startfile(file) on Windows, chmod 0700 + subprocess.Popen([file], start_new_session=True) on macOS. The remote server fully controls both the bytes written to disk and the destination path. The control-plane host is an anonymous Cloud Run default subdomain unrelated to the author identity in package metadata, consistent with an attacker-hosted collector-and-dropper rather than first-party vendor infrastructure. The AI-agent fingerprinting lets the operator select payloads for developer hosts running Claude Code, Cursor, or Codex.\n\n## Source: kam193 (6a8580750a7d490d65866e9407c451efa8dbad9a90c35a54b87416c57eef1fea)\nIn this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency (is-it-ai), intentionally pinned by specific versions of dependent packages. All package versions were uploaded with malicious intention; the ones without malicious references are clearly intendent only to hide a cover for the rest. When triggered, the malicious action fingerprints the environment and contacts the remote server. If it responds with an URL, it will be downloaded and executed.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-is-it-ai\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - The malicious code is intentionally included in a dependency of the package\n\n\n - targetted-attack\n\n\n - action-hidden-in-lib-usage\n","affected":[{"package":{"name":"is-it-ai","ecosystem":"PyPI","purl":"pkg:pypi/is-it-ai"},"versions":["0.1.0","0.1.1","0.1.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/is_it_ai/verifier.py","sha256":"e0f794aeb1591d4837eaa43a421cb4f0ed2c3ffe8b8170d812e95ecf76d4188c","tlsh":"066100a34c6e2822a3c7d266d856b1e4373279479e06b0747ded23582fc493093f62e9"},{"path":"src/is_it_ai/config/service.json","sha256":"fd1e3b2e43694c6f26cec5b3569f675a001b0bf35c64321e7ec7e2b2520bba2f","tlsh":"7a717766c0a86ca062ec24593587045705ba709b0cc37c1173dd83ad8f2ea7fc6ba79d"}],"package_integrity":[{"filename":"is_it_ai-0.1.1-py3-none-any.whl","hashes":{"blake2b_256":"5b2477c9b19367c14ca9b9cb596a6216de6efc6a2d6acc1a07f7aae34e5c3d15","md5":"4b5fcc3a21a8c11961f969aa305d77fe","sha256":"6e3a2530cebb78a1f8b67a7f6a7fa2bf38e382031d4295d1b64b43e6fce2834c"}},{"filename":"is_it_ai-0.1.1.tar.gz","hashes":{"blake2b_256":"64472bbbcf0bae2f9b6a1bdbfd7b61e8c33b6d45f4cb5df0a4a295b8d041f748","md5":"05410417b5c06e0e544ab550d62c6768","sha256":"e3c542d03edb65030213b9450e26953bd9b5326f68607dcff683d596f0082466"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/is-it-ai/MAL-2026-18426.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/is-it-ai"},{"type":"PACKAGE","url":"https://pypi.org/project/is-it-ai/0.1.1/"}],"database_specific":{"iocs":{"domains":["cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app"],"urls":["https://cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app/v1/session/info"]},"malicious-packages-origins":[{"id":"pypi/2026-10-is-it-ai/is-it-ai","import_time":"2026-10-31T13:10:11.833781919Z","modified_time":"2026-10-31T12:48:49.745072Z","sha256":"6a8580750a7d490d65866e9407c451efa8dbad9a90c35a54b87416c57eef1fea","source":"kam193","versions":["0.1.0","0.1.1","0.1.3"]},{"id":"IN-MAL-2026-022631","import_time":"2026-11-12T03:36:56.33893621Z","modified_time":"2026-11-12T03:34:29Z","sha256":"6c41881d21c4cb046c011c52db3d7725f8d936685710b170f3d4c116032a5158","source":"amazon-inspector","versions":["0.1.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-18432.json b/data/PyPI/MAL-2026-18432.json index 8f22fb0d97..e06680c8c3 100644 --- a/data/PyPI/MAL-2026-18432.json +++ b/data/PyPI/MAL-2026-18432.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"MAL-2026-18432","published":"2026-11-01T00:13:02Z","modified":"2026-11-01T00:45:06.421201356Z","summary":"Malicious code in pystr-codec (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (9f8b8630f88afc0b4a1aedeefb4e20adbf3fb9dea06f64747fb0bdf65c0a7bc1)\nPackage embeds a malicious PTH file that on every Python startup executes obfuscated JavaScript code, using a Bun engine. It then exfiltrates credentials to a public Github repository, establishes persistence awaiting remote commands, attempts spreading using discovered credentials as well as periodically checks if discovered credentials are valid. Once they are invalidated, it performs destructive actions on the local machine. It seems to be part of the Miasma-family worm (also known under testmetest).\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-pystr-codec\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - abuses-pth\n\n\n - infostealer\n\n\n - worm\n\n\n - backdoor\n\n\n - persistence\n\n\n - exfiltration-credentials\n\n\n - destructive-actions\n","affected":[{"package":{"name":"pystr-codec","ecosystem":"PyPI","purl":"pkg:pypi/pystr-codec"},"versions":["0.1.0","0.1.1","0.1.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pystr-codec/MAL-2026-18432.json"}}],"references":[{"type":"WEB","url":"https://safedep.io/testmetest-npm-worm-miasma-variant/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/pystr-codec"}],"database_specific":{"iocs":{"domains":["paleasbest.top"],"urls":["https://paleasbest.top/v1/api"]},"malicious-packages-origins":[{"id":"pypi/2026-11-pystr-codec/pystr-codec","import_time":"2026-11-01T00:35:45.944292912Z","modified_time":"2026-11-01T00:13:02.21675Z","sha256":"9f8b8630f88afc0b4a1aedeefb4e20adbf3fb9dea06f64747fb0bdf65c0a7bc1","source":"kam193","versions":["0.1.0","0.1.1","0.1.2"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"MAL-2026-18432","published":"2026-11-01T00:13:02Z","modified":"2026-11-12T04:30:04.138993176Z","summary":"Malicious code in pystr-codec (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (512abf8460812ee7c89336aa6734adcd7d3b502c8d6abcc9cbc891577c8ba7e4)\npystr-codec 0.1.1 installs a site-packages `.pth` file (pystr_codec-setup.pth) whose single line executes Python code on every interpreter startup, gated by a `/tmp/.bun_ran` sentinel. The executed code locates the sibling `pystr_codec/ci.js`, downloads the Bun runtime zip from github.com/oven-sh/bun/releases/download/bun-v1.2.18/bun--.zip into /tmp/b/bun, marks it executable, and invokes `bun run ci.js`. The `ci.js` file is a ~17MB artifact whose top level is `eval(caesar(hex_decode(), 7))`; the decoded JavaScript constructs an AES-128-GCM decryptor (`crypto.createDecipheriv('aes-128-gcm',...)`) with hardcoded key/IV bytes to decrypt and run a further payload. The package's `__init__.py` is empty and no documented functionality justifies the bundled runtime fetch or the encrypted JS blob. The combination — a.pth auto-execution vector, download and execution of a non-Python runtime from outside the Python ecosystem, and multi-layer obfuscation (hex + Caesar + AES-GCM) of the final executed code — fits the alternate-runtime dropper pattern and runs attacker-controlled code on the installer's host automatically on every Python start.\n\n## Source: kam193 (9f8b8630f88afc0b4a1aedeefb4e20adbf3fb9dea06f64747fb0bdf65c0a7bc1)\nPackage embeds a malicious PTH file that on every Python startup executes obfuscated JavaScript code, using a Bun engine. It then exfiltrates credentials to a public Github repository, establishes persistence awaiting remote commands, attempts spreading using discovered credentials as well as periodically checks if discovered credentials are valid. Once they are invalidated, it performs destructive actions on the local machine. It seems to be part of the Miasma-family worm (also known under testmetest).\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-pystr-codec\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - abuses-pth\n\n\n - infostealer\n\n\n - worm\n\n\n - backdoor\n\n\n - persistence\n\n\n - exfiltration-credentials\n\n\n - destructive-actions\n","affected":[{"package":{"name":"pystr-codec","ecosystem":"PyPI","purl":"pkg:pypi/pystr-codec"},"versions":["0.1.0","0.1.1","0.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"pystr_codec-setup.pth","sha256":"14dc1f185be61f2b0f49dc4118e48e44445d204c62106c01316b163cb64c5eba","tlsh":"de21305781038160da75d32bcb2525f8275b5cfb8e53875b8de8c9c03290d1197b2b8c"},{"path":"pystr_codec/ci.js","sha256":"87eca5d10087906f4d8c85b3f66017e2f4bdf3ab9fef253c4e0a439e1d9b83d2","tlsh":"b20787f0ae01d4c1f57e5b6bf3ed7908a1343227eadd5a4a00a466591ef6a01fd0ecc9"},{"path":"pystr_codec-0.1.2.dist-info/METADATA","sha256":"47cdd31d2ffb7881a80ad26f4e9a61c760286862133feaa449ab51892dfa61f9","tlsh":"cdb02200a20080b30800828b80ec0a2ac2fca30820be08ac8caa0220c383308c0308fc"}],"package_integrity":[{"filename":"pystr_codec-0.1.2-py3-none-any.whl","hashes":{"blake2b_256":"0a15d3da8a3aae99589a0606bdc00e174f01aeedcfc02150b89ec55b661794a4","md5":"9fec31a6d8c0c61be09dc8928bb9585f","sha256":"29a6134c9fe3849e9b84ce889d8ad59dc1b0b5fa6a9b710d4178fa1f736abf3b"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pystr-codec/MAL-2026-18432.json"}}],"references":[{"type":"WEB","url":"https://safedep.io/testmetest-npm-worm-miasma-variant/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/pystr-codec"},{"type":"PACKAGE","url":"https://pypi.org/project/pystr-codec/0.1.2/"},{"type":"PACKAGE","url":"https://pypi.org/project/pystr-codec/0.1.1/"}],"database_specific":{"iocs":{"domains":["paleasbest.top"],"urls":["https://paleasbest.top/v1/api"]},"malicious-packages-origins":[{"id":"pypi/2026-11-pystr-codec/pystr-codec","import_time":"2026-11-01T00:35:45.944292912Z","modified_time":"2026-11-01T00:13:02.21675Z","sha256":"9f8b8630f88afc0b4a1aedeefb4e20adbf3fb9dea06f64747fb0bdf65c0a7bc1","source":"kam193","versions":["0.1.0","0.1.1","0.1.2"]},{"id":"IN-MAL-2026-022638","import_time":"2026-11-12T04:13:26.92820707Z","modified_time":"2026-11-12T03:39:13Z","sha256":"1bac683aabaa62655d630fcba388d2f4b81940a5eb3b4fa4e27e106805307a0a","source":"amazon-inspector","versions":["0.1.2"]},{"id":"IN-MAL-2026-022639","import_time":"2026-11-12T04:13:27.004893886Z","modified_time":"2026-11-12T03:39:21Z","sha256":"512abf8460812ee7c89336aa6734adcd7d3b502c8d6abcc9cbc891577c8ba7e4","source":"amazon-inspector","versions":["0.1.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-18435.json b/data/PyPI/MAL-2026-18435.json index 4bff617a82..4e9774960f 100644 --- a/data/PyPI/MAL-2026-18435.json +++ b/data/PyPI/MAL-2026-18435.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"MAL-2026-18435","published":"2026-11-01T08:01:23Z","modified":"2026-11-01T09:45:03.305960502Z","summary":"Malicious code in privacypass-py (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0ca6e88317dac5ec524d2dc6ec4b2af7934e2213569ed7c8a757e59edb45b0c3)\nThe package presents itself as 'Privacy Pass client primitives' but ships no cryptographic functionality. Its only runtime effect is a data-exfiltration beacon. setup.py invokes a `_report()` routine during build/install that collects hostname, username, current working directory, argv, the parent process command line read from /proc//cmdline, and environment variable names and values matching credential-related prefixes (AWS_, GITHUB_, PIP_, and others), then POSTs the JSON payload to the hardcoded bare-IP endpoint http://85.190.112.236:8881/b/ over plain HTTP. privacypass_py/__init__.py repeats the same beacon at module top level, calling `_report('import')` on every `import privacypass_py` with an expanded prefix list (CLOUDFLARE_, SUPERTOKENS, HOME, USER, PATH) and an additional `secretish_names` list filtered by substrings KEY/SECRET/TOKEN/PASS/CRED/PRIVATE/SEED/MNEMONIC/SIGNATURE/COOKIE/SESSION/AUTH, sent to http://85.190.112.236:8881/f/. The import-time path fires outside pip build isolation. The name and description function as cover for a package whose only shipped code is the beacon.\n\n## Source: kam193 (1c4699b191565636c74fc5e6e8ece237bb0186ca11f021298ac91b2931756c09)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"privacypass-py","ecosystem":"PyPI","purl":"pkg:pypi/privacypass-py"},"versions":["0.1.101","0.1.99","0.1.100"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.py","sha256":"cea0614f670c026bcdd5bc600a13e5463c28d46412c242cd38739bcfee596810","tlsh":"9f415490ef227c7282d605096828459473bab90f2aa17474f6de23752f9e03982f3e56"},{"path":"privacypass_py/__init__.py","sha256":"4862a75e16b2e466f28ba5d71ee6097729502ac5e9294ebbdd0f069004ff5c96","tlsh":"f7515290ed229d33c29f411e2c1448e0333af40f36556535bacd2678af9d02d52f2d9a"}],"package_integrity":[{"filename":"privacypass_py-0.1.101.tar.gz","hashes":{"blake2b_256":"29851396f302ddcb3f730480a1de58a24b39982843a6aed068c33011cd3fd35e","md5":"e6c7c197293a5ae366da64052d704a35","sha256":"2427b1b03b2bdb8deab5d0d3d56273e462c59ff0d64f3134ff128745d69ecff3"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/privacypass-py/MAL-2026-18435.json"}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/privacypass-py/0.1.101/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/privacypass-py"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022471","import_time":"2026-11-01T08:14:47.241746113Z","modified_time":"2026-11-01T08:01:23Z","sha256":"0ca6e88317dac5ec524d2dc6ec4b2af7934e2213569ed7c8a757e59edb45b0c3","source":"amazon-inspector","versions":["0.1.101"]},{"id":"pypi/GENERIC-standard-pypi-install-pentest/privacypass-py","import_time":"2026-11-01T09:35:59.414959083Z","modified_time":"2026-11-01T09:03:03.776904Z","sha256":"1c4699b191565636c74fc5e6e8ece237bb0186ca11f021298ac91b2931756c09","source":"kam193","versions":["0.1.99","0.1.100","0.1.101"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"MAL-2026-18435","published":"2026-11-01T08:01:23Z","modified":"2026-11-12T03:45:03.273800640Z","summary":"Malicious code in privacypass-py (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0ca6e88317dac5ec524d2dc6ec4b2af7934e2213569ed7c8a757e59edb45b0c3)\nThe package presents itself as 'Privacy Pass client primitives' but ships no cryptographic functionality. Its only runtime effect is a data-exfiltration beacon. setup.py invokes a `_report()` routine during build/install that collects hostname, username, current working directory, argv, the parent process command line read from /proc//cmdline, and environment variable names and values matching credential-related prefixes (AWS_, GITHUB_, PIP_, and others), then POSTs the JSON payload to the hardcoded bare-IP endpoint http://85.190.112.236:8881/b/ over plain HTTP. privacypass_py/__init__.py repeats the same beacon at module top level, calling `_report('import')` on every `import privacypass_py` with an expanded prefix list (CLOUDFLARE_, SUPERTOKENS, HOME, USER, PATH) and an additional `secretish_names` list filtered by substrings KEY/SECRET/TOKEN/PASS/CRED/PRIVATE/SEED/MNEMONIC/SIGNATURE/COOKIE/SESSION/AUTH, sent to http://85.190.112.236:8881/f/. The import-time path fires outside pip build isolation. The name and description function as cover for a package whose only shipped code is the beacon.\n\n## Source: kam193 (1c4699b191565636c74fc5e6e8ece237bb0186ca11f021298ac91b2931756c09)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"privacypass-py","ecosystem":"PyPI","purl":"pkg:pypi/privacypass-py"},"versions":["0.1.101","0.1.99","0.1.100"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.py","sha256":"cea0614f670c026bcdd5bc600a13e5463c28d46412c242cd38739bcfee596810","tlsh":"9f415490ef227c7282d605096828459473bab90f2aa17474f6de23752f9e03982f3e56"},{"path":"privacypass_py/__init__.py","sha256":"4862a75e16b2e466f28ba5d71ee6097729502ac5e9294ebbdd0f069004ff5c96","tlsh":"f7515290ed229d33c29f411e2c1448e0333af40f36556535bacd2678af9d02d52f2d9a"}],"package_integrity":[{"filename":"privacypass_py-0.1.101.tar.gz","hashes":{"blake2b_256":"29851396f302ddcb3f730480a1de58a24b39982843a6aed068c33011cd3fd35e","md5":"e6c7c197293a5ae366da64052d704a35","sha256":"2427b1b03b2bdb8deab5d0d3d56273e462c59ff0d64f3134ff128745d69ecff3"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/privacypass-py/MAL-2026-18435.json"}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/privacypass-py/0.1.101/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/privacypass-py"},{"type":"PACKAGE","url":"https://pypi.org/project/privacypass-py/0.1.100/"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022471","import_time":"2026-11-01T08:14:47.241746113Z","modified_time":"2026-11-01T08:01:23Z","sha256":"0ca6e88317dac5ec524d2dc6ec4b2af7934e2213569ed7c8a757e59edb45b0c3","source":"amazon-inspector","versions":["0.1.101"]},{"id":"pypi/GENERIC-standard-pypi-install-pentest/privacypass-py","import_time":"2026-11-01T09:35:59.414959083Z","modified_time":"2026-11-01T09:03:03.776904Z","sha256":"1c4699b191565636c74fc5e6e8ece237bb0186ca11f021298ac91b2931756c09","source":"kam193","versions":["0.1.99","0.1.100","0.1.101"]},{"id":"IN-MAL-2026-022637","import_time":"2026-11-12T03:36:56.520042856Z","modified_time":"2026-11-12T03:35:50Z","sha256":"43b30cafa942acc32671e02709b88db00fab4a68602979f1509bd4d69dfadeab","source":"amazon-inspector","versions":["0.1.100"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-18490.json b/data/PyPI/MAL-2026-18490.json index a0320926bf..533fdc32a5 100644 --- a/data/PyPI/MAL-2026-18490.json +++ b/data/PyPI/MAL-2026-18490.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"MAL-2026-18490","published":"2026-11-02T22:11:26Z","modified":"2026-11-02T23:15:02.874644797Z","summary":"Malicious code in pyprig (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (11f4beddcb42e2348d31d2ef0605d72198a28e796467c8afbac5c5c30d870315)\nClone of a legitimate Pydantic package with the added downloading of a remote code. The remote code is delivered from the GitHub repository and unpacked as a new module and then called during initialization of any models (runner injected into cloned Pydantic code). During analysis, the remote code was just a placeholder.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-pyprig\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - clones-real-package\n","affected":[{"package":{"name":"pyprig","ecosystem":"PyPI","purl":"pkg:pypi/pyprig"},"versions":["1.2.0","1.2.1","1.2.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pyprig/MAL-2026-18490.json"}}],"references":[{"type":"WEB","url":"https://github.com/PyPrig/pyprig-validation-toolkit"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/pyprig"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-11-pyprig/pyprig","import_time":"2026-11-02T23:10:57.383268222Z","modified_time":"2026-11-02T22:11:26.957755Z","sha256":"11f4beddcb42e2348d31d2ef0605d72198a28e796467c8afbac5c5c30d870315","source":"kam193","versions":["1.2.0","1.2.1","1.2.2"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"MAL-2026-18490","published":"2026-11-02T22:11:26Z","modified":"2026-11-12T04:30:04.152916010Z","summary":"Malicious code in pyprig (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (83ccb335aa01c8a31acb208aa2f1c2654ab010f9f3cc29fd2f1e6f60a44113f8)\npyprig impersonates pydantic: the package name, description ('Data validation using Python type hints'), and README are near-verbatim clones of pydantic, and pyproject.toml lists pydantic's real maintainers (Samuel Colvin, Eric Jolibois, Hasan Ramezani, David Hewitt, et al.) as authors. The top-level pyprig/__init__.py unconditionally calls get_help() from pyprig/help.py on every import. get_help() downloads https://github.com/PyPrig/pyprig-help/archive/refs/heads/main.zip from the mutable main branch with no commit pin and no hash or signature verification, then extracts the archive into the installed package tree at /pyprig/help/ via archive.extractall followed by shutil.copytree into HELP_DIR = PACKAGE_DIR / 'help'. Because the files land inside the Python package directory, whoever controls the PyPrig/pyprig-help repository can replace them at any time to stage Python files that are then importable from within the package, giving arbitrary code execution on any machine that imports pyprig after the swap.\n\n## Source: kam193 (11f4beddcb42e2348d31d2ef0605d72198a28e796467c8afbac5c5c30d870315)\nClone of a legitimate Pydantic package with the added downloading of a remote code. The remote code is delivered from the GitHub repository and unpacked as a new module and then called during initialization of any models (runner injected into cloned Pydantic code). During analysis, the remote code was just a placeholder.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-pyprig\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - clones-real-package\n","affected":[{"package":{"name":"pyprig","ecosystem":"PyPI","purl":"pkg:pypi/pyprig"},"versions":["1.2.0","1.2.1","1.2.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"pyprig/help.py","sha256":"faf8ee4f5fa421e08ccc4a38349cdc4c938b04887fba173aeca33497db31ee3c","tlsh":"9a411f534c93319091b8e50c5ed59497f323f1c32ebb58a336bc5f642fb0ad1a2e9289"},{"path":"pyproject.toml","sha256":"8cecd88a3bf9b539fbd0153d872772a0ec6b6615ade8332513f318cb03c49889","tlsh":"d202b6b394fb11b72a8b5513d1ac4e4257246073ee82b5a8bdec85885fcceadc1b1138"}],"package_integrity":[{"filename":"pyprig-1.2.1-py3-none-any.whl","hashes":{"blake2b_256":"46f7103e59c83d57032c7de914561a40c79e7fb9d03d4b3caa5f0f6bdcd91744","md5":"d8546bf9f83687c9d153165cbeb5f072","sha256":"700038278fe5e82f7ba5e2833ea578c6b7441f7b9368f0fbef5a6491b835a81f"}},{"filename":"pyprig-1.2.1.tar.gz","hashes":{"blake2b_256":"f35f97c643ac0a5fdf85b73ff94ab380a34663ad7f65d8df37ed79d8517cb892","md5":"e427ad9010e761f2cb90809b257682d3","sha256":"74a0ff110c95245ad491eba59bc417f7fbf8ad0cf234d2be5124a4970de1b438"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pyprig/MAL-2026-18490.json"}}],"references":[{"type":"WEB","url":"https://github.com/PyPrig/pyprig-validation-toolkit"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/pyprig"},{"type":"PACKAGE","url":"https://pypi.org/project/pyprig/1.2.1/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-11-pyprig/pyprig","import_time":"2026-11-02T23:10:57.383268222Z","modified_time":"2026-11-02T22:11:26.957755Z","sha256":"11f4beddcb42e2348d31d2ef0605d72198a28e796467c8afbac5c5c30d870315","source":"kam193","versions":["1.2.0","1.2.1","1.2.2"]},{"id":"IN-MAL-2026-022640","import_time":"2026-11-12T04:13:27.083157068Z","modified_time":"2026-11-12T03:39:49Z","sha256":"83ccb335aa01c8a31acb208aa2f1c2654ab010f9f3cc29fd2f1e6f60a44113f8","source":"amazon-inspector","versions":["1.2.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-18627.json b/data/PyPI/MAL-2026-18627.json index 83341f5297..c3da854d80 100644 --- a/data/PyPI/MAL-2026-18627.json +++ b/data/PyPI/MAL-2026-18627.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"MAL-2026-18627","published":"2026-11-04T16:11:42Z","modified":"2026-11-04T16:45:04.332052887Z","summary":"Malicious code in msgpackrpc (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (9747a902bd61a745ec9c8f569f57417303f828b441c3e4e8c95101adf1498d13)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"msgpackrpc","ecosystem":"PyPI","purl":"pkg:pypi/msgpackrpc"},"versions":["0.0.0","0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/msgpackrpc/MAL-2026-18627.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/msgpackrpc"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/GENERIC-standard-pypi-install-pentest/msgpackrpc","import_time":"2026-11-04T16:37:36.802736375Z","modified_time":"2026-11-04T16:11:42.068096Z","sha256":"9747a902bd61a745ec9c8f569f57417303f828b441c3e4e8c95101adf1498d13","source":"kam193","versions":["0.0.0","0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"MAL-2026-18627","published":"2026-11-04T16:11:42Z","modified":"2026-11-12T00:45:06.780823829Z","summary":"Malicious code in msgpackrpc (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (55c4f419c883d30c0099a7120b0456d975af824e08310e0750166d074def3204)\nThe sdist's setup.py overrides the install command with a class that, during `pip install`, collects the installer's hostname via socket.gethostname() and resolves its IP via socket.gethostbyname(), then POSTs them as JSON to a hardcoded webhook.site collector URL (https://webhook.site/711f31ae-7091-4b68-9631-57b6c6f19980) using urllib.request.urlopen. The package ships no actual functionality: msgpackrpc/__init__.py is empty, the project metadata self-describes as a 'POC package (beacon-only)', and the author field is the placeholder 'Your Name'. The package name is a typosquat shape against the legitimate msgpack-rpc ecosystem. Installing this version causes the installer's host identifiers to leave the machine to an attacker-controlled endpoint with no disclosure or consent.\n\n## Source: kam193 (9747a902bd61a745ec9c8f569f57417303f828b441c3e4e8c95101adf1498d13)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"msgpackrpc","ecosystem":"PyPI","purl":"pkg:pypi/msgpackrpc"},"versions":["0.0.0","0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["msgpackrpc-0.1.0.tar.gz"],"path":"setup.py","sha256":"5e3b5827437a8bd3649abf9f1df6957904acb8eff37c4b217f35777ce1a329ce","tlsh":"7e11ef92f872b165bb8321d0086789653693ba0bbb02ec6d3dcc43584fae439d861658"},{"artifacts":["msgpackrpc-0.1.0.tar.gz"],"path":"pyproject.toml","sha256":"e6d8a6e833ab20a03d2d5646688bf639eb21d6ec3a11362207ade35eac9c0188","tlsh":"d3e07d23cbb7db40adc210412019b484debaf45531c081485fcbc1c5a5cd48acbde824"}],"package_integrity":[{"filename":"msgpackrpc-0.1.0.tar.gz","hashes":{"blake2b_256":"889692f8afddd60dbe93c6700f6aacc245b4a5aea74686acfadc959f757c6792","md5":"64a7bb442d523e701f9e9c0a000ade16","sha256":"3d959a9588a3fb96d4a558484dca090c4d3a42a6bdbb8d38882bda9ef7a7c4da"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/msgpackrpc/MAL-2026-18627.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/msgpackrpc"},{"type":"PACKAGE","url":"https://pypi.org/project/msgpackrpc/0.1.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/GENERIC-standard-pypi-install-pentest/msgpackrpc","import_time":"2026-11-04T16:37:36.802736375Z","modified_time":"2026-11-04T16:11:42.068096Z","sha256":"9747a902bd61a745ec9c8f569f57417303f828b441c3e4e8c95101adf1498d13","source":"kam193","versions":["0.0.0","0.1.0"]},{"id":"IN-MAL-2026-022626","import_time":"2026-11-12T00:30:24.934663162Z","modified_time":"2026-11-11T23:47:58Z","sha256":"55c4f419c883d30c0099a7120b0456d975af824e08310e0750166d074def3204","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-18706.json b/data/PyPI/MAL-2026-18706.json index 5a8015f328..9202ba7c1f 100644 --- a/data/PyPI/MAL-2026-18706.json +++ b/data/PyPI/MAL-2026-18706.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"MAL-2026-18706","published":"2026-11-05T12:29:01Z","modified":"2026-11-05T17:15:06.041975216Z","summary":"Malicious code in mcp-teamviewer (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (54d27496a09fce8a393650469621dc308a6578c6cf694589bda9d4b298a6c08e)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n## Source: ossf-package-analysis (a5d59e94208df065ea45c96e99b262462ea08b134b85f9d1f707f4350623d7ff)\nThe OpenSSF Package Analysis project identified 'mcp-teamviewer' @ 0.0.1 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"mcp-teamviewer","ecosystem":"PyPI","purl":"pkg:pypi/mcp-teamviewer"},"versions":["0.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/mcp-teamviewer/MAL-2026-18706.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/mcp-teamviewer"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-11-05T12:38:33.75810882Z","modified_time":"2026-11-05T12:29:01Z","sha256":"a5d59e94208df065ea45c96e99b262462ea08b134b85f9d1f707f4350623d7ff","source":"ossf-package-analysis","versions":["0.0.1"]},{"id":"pypi/GENERIC-standard-pypi-install-pentest/mcp-teamviewer","import_time":"2026-11-05T17:12:13.236661279Z","modified_time":"2026-11-05T16:35:02.511643Z","sha256":"54d27496a09fce8a393650469621dc308a6578c6cf694589bda9d4b298a6c08e","source":"kam193","versions":["0.0.1"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"MAL-2026-18706","published":"2026-11-05T12:29:01Z","modified":"2026-11-12T00:45:06.754525270Z","summary":"Malicious code in mcp-teamviewer (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (108ea237ed659c21bd0e896db8184187b0c6e34b07d1c7659365db70e8857551)\nOn import of the top-level mcp_teamviewer module, the package constructs a DNS label from the installer's USER/USERNAME, hostname (platform.node), operating system, and current working directory, then calls socket.getaddrinfo() against that label as a subdomain of oast.me (an out-of-band interact collector). The call fires at module scope, so importing the package — including via the installed console_script mcp-teamviewer, which imports the package to resolve main — transmits those host identifiers to the collector over DNS. The package metadata self-describes as a 'dependency confusion canary' for responsible disclosure, but the beacon is unconditional, undocumented in any installer-visible consent step, and sends identity data to a third-party collector the installer did not configure. No install-time build hooks are present; the harm occurs on import of the pure-Python wheel.\n\n## Source: kam193 (54d27496a09fce8a393650469621dc308a6578c6cf694589bda9d4b298a6c08e)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n## Source: ossf-package-analysis (a5d59e94208df065ea45c96e99b262462ea08b134b85f9d1f707f4350623d7ff)\nThe OpenSSF Package Analysis project identified 'mcp-teamviewer' @ 0.0.1 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"mcp-teamviewer","ecosystem":"PyPI","purl":"pkg:pypi/mcp-teamviewer"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["mcp_teamviewer-0.0.1.tar.gz","mcp_teamviewer-0.0.1-py3-none-any.whl"],"path":"src/mcp_teamviewer/__init__.py","sha256":"edb5d8fb2311ec004137bd50633afb6743a78db172b5705756baa306c1669beb","tlsh":"fd21dd245e201d72974f055d9c161901053f6d6347be7858f98e0ed89fa9a76e061d38"},{"artifacts":["mcp_teamviewer-0.0.1.tar.gz"],"path":"pyproject.toml","sha256":"bfd750d9b9050306a127f3a5bac0c016299bad24cc5812e3441deb59c662dccd","tlsh":"22f05c769903b475deaf505098b40706e8b5701af1c0755af28f8144a00ded5e7e2436"}],"package_integrity":[{"filename":"mcp_teamviewer-0.0.1-py3-none-any.whl","hashes":{"blake2b_256":"a690b60ad41660b9aa6d886b234e606cb57c067b954d0273f7970ba7a16e84ea","md5":"9118b202aa81f9c0d555376908d5811a","sha256":"8ec23cf764613507a47345bc8b3df04754596826c7317e93ef230f8e56ec894c"}},{"filename":"mcp_teamviewer-0.0.1.tar.gz","hashes":{"blake2b_256":"9831666bcfc5057861406bdd0e2a833dd5ef147266995d9f453ce76212820426","md5":"23647344379181c305bffa6f2e6e1817","sha256":"d226d40b1b6212e914c1e78983d57cd316cd1780c40d508f6b2614a62d184cba"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/mcp-teamviewer/MAL-2026-18706.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/mcp-teamviewer"},{"type":"PACKAGE","url":"https://pypi.org/project/mcp-teamviewer/0.0.1/"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-11-05T12:38:33.75810882Z","modified_time":"2026-11-05T12:29:01Z","sha256":"a5d59e94208df065ea45c96e99b262462ea08b134b85f9d1f707f4350623d7ff","source":"ossf-package-analysis","versions":["0.0.1"]},{"id":"pypi/GENERIC-standard-pypi-install-pentest/mcp-teamviewer","import_time":"2026-11-05T17:12:13.236661279Z","modified_time":"2026-11-05T16:35:02.511643Z","sha256":"54d27496a09fce8a393650469621dc308a6578c6cf694589bda9d4b298a6c08e","source":"kam193","versions":["0.0.1"]},{"id":"IN-MAL-2026-022625","import_time":"2026-11-12T00:30:24.824714125Z","modified_time":"2026-11-11T23:47:25Z","sha256":"108ea237ed659c21bd0e896db8184187b0c6e34b07d1c7659365db70e8857551","source":"amazon-inspector","versions":["0.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-18746.json b/data/PyPI/MAL-2026-18746.json index 1b7c2df76d..e73bf43a5d 100644 --- a/data/PyPI/MAL-2026-18746.json +++ b/data/PyPI/MAL-2026-18746.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"MAL-2026-18746","published":"2026-11-07T08:32:18Z","modified":"2026-11-07T08:45:03.213207645Z","summary":"Malicious code in genblaze-fal (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (253796cb8693d039c09267f3d6d398031e3ad27640bb70f21f2e75d2578be649)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"genblaze-fal","ecosystem":"PyPI","purl":"pkg:pypi/genblaze-fal"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/genblaze-fal/MAL-2026-18746.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/genblaze-fal"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/GENERIC-standard-pypi-install-pentest/genblaze-fal","import_time":"2026-11-07T08:36:36.403321334Z","modified_time":"2026-11-07T08:32:18.92264Z","sha256":"253796cb8693d039c09267f3d6d398031e3ad27640bb70f21f2e75d2578be649","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"MAL-2026-18746","published":"2026-11-07T08:32:18Z","modified":"2026-11-12T03:45:03.293519056Z","summary":"Malicious code in genblaze-fal (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8a271155be7da40cba43376d6a085b75a96c0bb9fed885c421424bc42fd8d07b)\nsetup.py defines custom build_py and install cmdclasses that, on sdist build and install, POST a JSON payload containing the installer's hostname, current working directory, install path, Python version, and a timestamp to the hardcoded bare-IP URL http://13.140.137.222:8787/_ah/dc over plain HTTP. The destination is a bare IPv4 address on a non-standard port with no TLS and no relation to any declared publisher domain. A source-code comment labels the behavior an 'authorized dependency-confusion canary', but the package is published on public PyPI where any installer who resolves this name will transmit their host identifiers to that endpoint. The sdist is the only distribution file and auto-executes on default pip install for every listed platform.\n\n## Source: kam193 (253796cb8693d039c09267f3d6d398031e3ad27640bb70f21f2e75d2578be649)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"genblaze-fal","ecosystem":"PyPI","purl":"pkg:pypi/genblaze-fal"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["genblaze_fal-0.1.0.tar.gz"],"path":"setup.py","sha256":"a9ba1e323ebfe7804887462cae68afed20996aa58049e9f8286940031900c40a","tlsh":"2b418660c92609787ecb41a5a8fb66947332ba272d40bc9578cd07481f0f0ff89b72c5"}],"package_integrity":[{"filename":"genblaze_fal-0.1.0.tar.gz","hashes":{"blake2b_256":"14f156c083988e29272500c0dd47e8c55d765925740c4d9fa8555876b303bb20","md5":"e1c3bc03bb78e4b7ef71ab5c9c4b99b5","sha256":"ac4c445f1701dd9a99150129ab196e77ad207d1295c99d6dc95b01636b88d454"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/genblaze-fal/MAL-2026-18746.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/genblaze-fal"},{"type":"PACKAGE","url":"https://pypi.org/project/genblaze-fal/0.1.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/GENERIC-standard-pypi-install-pentest/genblaze-fal","import_time":"2026-11-07T08:36:36.403321334Z","modified_time":"2026-11-07T08:32:18.92264Z","sha256":"253796cb8693d039c09267f3d6d398031e3ad27640bb70f21f2e75d2578be649","source":"kam193","versions":["0.1.0"]},{"id":"IN-MAL-2026-022627","import_time":"2026-11-12T03:36:56.209736663Z","modified_time":"2026-11-12T03:31:54Z","sha256":"8a271155be7da40cba43376d6a085b75a96c0bb9fed885c421424bc42fd8d07b","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-18747.json b/data/PyPI/MAL-2026-18747.json index 7b5c361e09..e274f2e674 100644 --- a/data/PyPI/MAL-2026-18747.json +++ b/data/PyPI/MAL-2026-18747.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"MAL-2026-18747","published":"2026-11-07T08:34:31Z","modified":"2026-11-07T09:15:03.145542032Z","summary":"Malicious code in genblaze-atlascloud (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (c8d0787ea4049d0bb0321d1b25591f303ee2a5d5351aeb725a67250d0ddf4188)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"genblaze-atlascloud","ecosystem":"PyPI","purl":"pkg:pypi/genblaze-atlascloud"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/genblaze-atlascloud/MAL-2026-18747.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/genblaze-atlascloud"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/GENERIC-standard-pypi-install-pentest/genblaze-atlascloud","import_time":"2026-11-07T09:11:45.278379612Z","modified_time":"2026-11-07T08:34:31.241966Z","sha256":"c8d0787ea4049d0bb0321d1b25591f303ee2a5d5351aeb725a67250d0ddf4188","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"MAL-2026-18747","published":"2026-11-07T08:34:31Z","modified":"2026-11-12T03:45:03.294926426Z","summary":"Malicious code in genblaze-atlascloud (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6279c5d7cd957549bcecd8c2e4aa1377bf53c114341a3350a23464de6e18bad9)\nsetup.py registers custom build_py and install cmdclasses that, on every `pip install` or sdist build, POST a JSON payload containing socket.gethostname(), the install path, os.getcwd(), the Python version, and a canary identifier to the hardcoded bare-IP endpoint http://13.140.137.222:8787/_ah/dc over plain HTTP. The destination is a non-publisher bare IP, there is no opt-in, and the package name resembles an internal vendor name, so any environment whose internal dependency resolves to this public name has host and path identifiers transmitted off-host at install time. The long_description self-labels this as an 'authorized dependency-confusion canary' targeting Backblaze/Bugcrowd, but the exfiltration mechanism is identical to a hostile dependency-confusion payload and the authorization claim is author-controlled text that an installer cannot verify at install time.\n\n## Source: kam193 (c8d0787ea4049d0bb0321d1b25591f303ee2a5d5351aeb725a67250d0ddf4188)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"genblaze-atlascloud","ecosystem":"PyPI","purl":"pkg:pypi/genblaze-atlascloud"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["genblaze_atlascloud-0.1.0.tar.gz"],"path":"setup.py","sha256":"2fa7b8d44c0523e237e79a3ebf0dc4f8e3a94dafe9d2ec1cbc0ccf7fd6e58d19","tlsh":"25419671c92209783ecb41a998f756506332ea271d41bc95b8cd07481f0f0ff89b71c1"}],"package_integrity":[{"filename":"genblaze_atlascloud-0.1.0.tar.gz","hashes":{"blake2b_256":"69b1dd23d9743b78fdd11627101ce24aef63829c0f43e3ad73325516e52f266d","md5":"9afee767843f9394f99104a7e502dbba","sha256":"bdac6b1140ac33683d52641e6031ab5b6263dabb4d74eee373d1d1b32c4a9633"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/genblaze-atlascloud/MAL-2026-18747.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/genblaze-atlascloud"},{"type":"PACKAGE","url":"https://pypi.org/project/genblaze-atlascloud/0.1.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/GENERIC-standard-pypi-install-pentest/genblaze-atlascloud","import_time":"2026-11-07T09:11:45.278379612Z","modified_time":"2026-11-07T08:34:31.241966Z","sha256":"c8d0787ea4049d0bb0321d1b25591f303ee2a5d5351aeb725a67250d0ddf4188","source":"kam193","versions":["0.1.0"]},{"id":"IN-MAL-2026-022628","import_time":"2026-11-12T03:36:56.256874897Z","modified_time":"2026-11-12T03:33:44Z","sha256":"6279c5d7cd957549bcecd8c2e4aa1377bf53c114341a3350a23464de6e18bad9","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-18769.json b/data/PyPI/MAL-2026-18769.json index 440c09ab4d..5d6430c2b9 100644 --- a/data/PyPI/MAL-2026-18769.json +++ b/data/PyPI/MAL-2026-18769.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"MAL-2026-18769","published":"2026-11-08T13:51:47Z","modified":"2026-11-08T14:15:05.147670216Z","summary":"Malicious code in lookuptest11 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (fe5cc784eb96a4025bcd45731fcb19c3826a122a02ec4fed1cbee875fa2ca98b)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"lookuptest11","ecosystem":"PyPI","purl":"pkg:pypi/lookuptest11"},"versions":["0.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/lookuptest11/MAL-2026-18769.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/lookuptest11"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/GENERIC-standard-pypi-install-pentest/lookuptest11","import_time":"2026-11-08T14:10:37.569263977Z","modified_time":"2026-11-08T13:51:47.432846Z","sha256":"fe5cc784eb96a4025bcd45731fcb19c3826a122a02ec4fed1cbee875fa2ca98b","source":"kam193","versions":["0.0.1"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"MAL-2026-18769","published":"2026-11-08T13:51:47Z","modified":"2026-11-12T00:45:06.791373992Z","summary":"Malicious code in lookuptest11 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5e9ac24971ad447f0248f201416c1921ca268ddb73ad057eee44eaf4868efb17)\nlookuptest11 0.0.1 performs DNS-based exfiltration of installer identity to the attacker-controlled domain testa213022.dssldrf.net. setup.py constructs a subdomain label of the form install-- from platform.node() and calls socket.getaddrinfo(label.testa213022.dssldrf.net, 80), causing the authoritative nameserver for that domain to receive the installer's hostname on every sdist build. gcp_log_poc/__init__.py performs the equivalent lookup with an import-- label at module load, so the same leak fires on every import of the installed wheel. The package exposes no functional API consistent with its name; the DNS calls are the only observable behavior and have no build or runtime purpose other than delivering host identifiers to the operator of testa213022.dssldrf.net.\n\n## Source: kam193 (fe5cc784eb96a4025bcd45731fcb19c3826a122a02ec4fed1cbee875fa2ca98b)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"lookuptest11","ecosystem":"PyPI","purl":"pkg:pypi/lookuptest11"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["lookuptest11-0.0.1.tar.gz"],"path":"setup.py","sha256":"3ccf00a87011bd3d73996310920d3ed92e43ac1c9f620b6eab83da6b18a6a023","tlsh":"8ce06a02c7339c5319a0168904f520b14f3f46133f32144d77c503205f9f05a8436617"},{"artifacts":["lookuptest11-0.0.1.tar.gz","lookuptest11-0.0.1-py3-none-any.whl"],"path":"gcp_log_poc/__init__.py","sha256":"4f4433d1b9b0dfe50d840daa089f6e931b6e984b1f9dc41fc41fa80a8299137e","tlsh":"0cd02b07e3b59c43a66222c700e871719e7f81026f2a1c6e69991b91cfaa4649535b54"}],"package_integrity":[{"filename":"lookuptest11-0.0.1-py3-none-any.whl","hashes":{"blake2b_256":"b173948ea61f9b3013a0f9f775a3909487f7dddf425d2fc916d08ce883a74867","md5":"f6e29412b0dc4d937f1e847cbbdec816","sha256":"74173d4860dfe393aa6a45e3382eb2075df92ccfb194fedfac3b7c2539038765"}},{"filename":"lookuptest11-0.0.1.tar.gz","hashes":{"blake2b_256":"feecdc8d300614c7199e8579ae2861b17f8f522a8693aa9d392fe3ce29d3858a","md5":"c6a2113b43e9c62773c6d4e62dc0d515","sha256":"c8874aaaf0544cf5207f3de9a19611e3d9e5ef1657747e20b69e1d7354df628c"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/lookuptest11/MAL-2026-18769.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/lookuptest11"},{"type":"PACKAGE","url":"https://pypi.org/project/lookuptest11/0.0.1/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/GENERIC-standard-pypi-install-pentest/lookuptest11","import_time":"2026-11-08T14:10:37.569263977Z","modified_time":"2026-11-08T13:51:47.432846Z","sha256":"fe5cc784eb96a4025bcd45731fcb19c3826a122a02ec4fed1cbee875fa2ca98b","source":"kam193","versions":["0.0.1"]},{"id":"IN-MAL-2026-022624","import_time":"2026-11-12T00:30:24.653151672Z","modified_time":"2026-11-11T23:47:12Z","sha256":"5e9ac24971ad447f0248f201416c1921ca268ddb73ad057eee44eaf4868efb17","source":"amazon-inspector","versions":["0.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-18772.json b/data/PyPI/MAL-2026-18772.json index 35f9f54409..6049fb14ab 100644 --- a/data/PyPI/MAL-2026-18772.json +++ b/data/PyPI/MAL-2026-18772.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"MAL-2026-18772","published":"2026-11-08T21:45:25Z","modified":"2026-11-08T22:45:03.359292162Z","summary":"Malicious code in parseyaml (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (21f0c643e1ed1b11c56bfdd5f7567b2c0172924c227206b8ab9e4210918c6ee3)\nIn this campaign, remote code is executed via a dependency pretending to be a YAML loader but embedding a special loader executing code from a provided file. During analysis, the code was just a stub.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-parseyaml\n\n\nReasons (based on the campaign):\n\n\n - The malicious code is intentionally included in a dependency of the package\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"parseyaml","ecosystem":"PyPI","purl":"pkg:pypi/parseyaml"},"versions":["1.2.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/parseyaml/MAL-2026-18772.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/parseyaml"}],"database_specific":{"iocs":{"urls":["https://plainraw.com/raw/99b69bda4246"]},"malicious-packages-origins":[{"id":"pypi/2026-11-parseyaml/parseyaml","import_time":"2026-11-08T22:36:34.682518859Z","modified_time":"2026-11-08T21:45:25.933688Z","sha256":"21f0c643e1ed1b11c56bfdd5f7567b2c0172924c227206b8ab9e4210918c6ee3","source":"kam193","versions":["1.2.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"MAL-2026-18772","published":"2026-11-08T21:45:25Z","modified":"2026-11-12T03:45:03.276981731Z","summary":"Malicious code in parseyaml (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (42b56cbea8e7b46f2ad7dc1d59334a45862f50366944ee198e97c68a313681ef)\nparseyaml 1.2.0 advertises itself as a PyYAML wrapper whose `safe_load`, `load(loader=\"safe\")`, `load(loader=\"full\")`, and `load(loader=\"base\")` entry points return only basic YAML types. The implementation defines `_LOADERS = {\"default\": UnsafePyLoader, \"safe\": UnsafePyLoader, \"full\": UnsafePyLoader, \"base\": UnsafePyLoader, \"unsafe_py\": UnsafePyLoader}`, so every documented safe-loader name resolves to `UnsafePyLoader`. `UnsafePyLoader` registers a `!py` tag constructor (`_unsafe_py_constructor`) that calls `exec(code, {})` on the scalar body of the tag. Any caller that follows the package's own documentation and feeds attacker-supplied YAML containing a `!py` tag through what it believes is a safe loader will execute attacker-controlled Python in the host process. The exec sink is hidden inside loader names explicitly promised to be safe for untrusted input, which is a backdoor built into the advertised safe API rather than a documented unsafe option.\n\n## Source: kam193 (21f0c643e1ed1b11c56bfdd5f7567b2c0172924c227206b8ab9e4210918c6ee3)\nIn this campaign, remote code is executed via a dependency pretending to be a YAML loader but embedding a special loader executing code from a provided file. During analysis, the code was just a stub.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-parseyaml\n\n\nReasons (based on the campaign):\n\n\n - The malicious code is intentionally included in a dependency of the package\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"parseyaml","ecosystem":"PyPI","purl":"pkg:pypi/parseyaml"},"versions":["1.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["parseyaml-1.2.0.tar.gz","parseyaml-1.2.0-py3-none-any.whl"],"path":"parseyaml/core.py","sha256":"acac40be1b8b623d2780ca0107d1496cc6840aff82fc1fafe714f8820ec840a9","tlsh":"acd13543e650ed924740deb5691afe42ada8bf470d0075b5bcacc12c9fda0adf0b45d8"}],"package_integrity":[{"filename":"parseyaml-1.2.0-py3-none-any.whl","hashes":{"blake2b_256":"c9d370fc0dcf046594bd36afa695732e0312c3e98eeb27fc7e4e3b9be4a57edf","md5":"9c8cbae2e8005002dcb2e11ee460b060","sha256":"9fe4bb1b97e5945c3d291465e32b325c3fbb0f0a50c92f9e925831296a47898d"}},{"filename":"parseyaml-1.2.0.tar.gz","hashes":{"blake2b_256":"6ba29e013de73cccde58773a53a842aaff7d685dd05134cc08754846710fe5b0","md5":"0060d69225b4f6d44cadc1a06c29b224","sha256":"5fe6da25a8b07825af947a478e9ce783386ce9504d8870c96a9e03aa284c405e"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/parseyaml/MAL-2026-18772.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/parseyaml"},{"type":"PACKAGE","url":"https://pypi.org/project/parseyaml/1.2.0/"}],"database_specific":{"iocs":{"urls":["https://plainraw.com/raw/99b69bda4246"]},"malicious-packages-origins":[{"id":"pypi/2026-11-parseyaml/parseyaml","import_time":"2026-11-08T22:36:34.682518859Z","modified_time":"2026-11-08T21:45:25.933688Z","sha256":"21f0c643e1ed1b11c56bfdd5f7567b2c0172924c227206b8ab9e4210918c6ee3","source":"kam193","versions":["1.2.0"]},{"id":"IN-MAL-2026-022636","import_time":"2026-11-12T03:36:56.495828396Z","modified_time":"2026-11-12T03:35:38Z","sha256":"42b56cbea8e7b46f2ad7dc1d59334a45862f50366944ee198e97c68a313681ef","source":"amazon-inspector","versions":["1.2.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-18778.json b/data/PyPI/MAL-2026-18778.json index d74f1358f8..0ac7563e1e 100644 --- a/data/PyPI/MAL-2026-18778.json +++ b/data/PyPI/MAL-2026-18778.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"MAL-2026-18778","published":"2026-11-09T08:18:27Z","modified":"2026-11-11T21:15:15.167248209Z","summary":"Malicious code in logger-libs (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ba7ca01d22004220ca07b3bc1ccd0e735f150bad7ce18f1539a90a88687f447b)\nThe package publishes under a name resembling the legitimate `log-utils`/`logger_util` library (README imports `logger_util.helper`, setup.py url points at `github.com/wolf1986/logger_libss` with a doubled-s typo). On `from logger_libs.helper import LogHelper` — the import pattern the README instructs users to perform — the `LogHelper` class body reconstructs a Python source string by concatenating `COLOR_INDEX`/`ALT_CODE` fragments scattered across `logger_libs/themes/theme_000.py` through `theme_099.py` and files under `logger_libs/ansi/`, in a shuffled `ORDER`, then base64-decodes and XORs the result with the keys `palette-build-2024` and `ansi-const-7f3a`. The decoded source is passed to a chr-code-aliased `exec` (`_BUILTIN_EXEC = getattr(builtins, chr(101)+chr(120)+chr(101)+chr(99))` in `logger_libs/_compat.py`), with `requests`, `subprocess`, `ctypes`, and related modules preloaded into the exec namespace. Immediately before invoking exec, `logging_color_set` monkey-patches `subprocess.Popen`, `subprocess.run`, `subprocess.call`, and `subprocess.check_output` so any invocation shaped `[python, '-c',