1 line
5.5 KiB
JSON
1 line
5.5 KiB
JSON
{"schema_version":"1.9.2","id":"MAL-2026-18767","published":"2026-11-08T11:31:04Z","modified":"2026-11-11T21:15:15.211351924Z","summary":"Malicious code in supercolor-tui (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9505cdfb58ccf88da6eb5f64f02c194dbfbf1f149f1bde76118d8cab52a6760b)\nThe package advertises itself as a terminal color helper, but every documented call into the Color API (Color.paint, Color.print, Color.__call__, e.g. colors.red.print(...)) invokes an internal _run_payload() routine. On Windows this routine attempts UAC elevation, disables Microsoft Defender via PowerShell (Set-MpPreference -DisableRealtimeMonitoring, Stop-Service WinDefend/WdNisSvc/Sense/SecurityHealthService, Add-MpPreference -ExclusionPath pointing at the staging folder) and writes Defender-disabling registry policies (DisableAntiSpyware), then downloads an opaque executable from a Discord CDN URL (cdn.discordapp.com/attachments/.../bedwars.exe) to %TEMP%\\SolaceRuntime\\bedwars.exe and spawns it detached. The attacker-controlled host is a mutable third-party CDN, the payload is unverified, and the dropper is wired into the library's normal, README-documented entry points so any downstream Windows user of the library executes it. The color-helper framing is a cover story: a TUI color library has no legitimate need to disable AV or fetch and execute Windows binaries.\n\n## Source: kam193 (9798fa32337256d29d4b551193b6aa6817601034ce787bae4d09d7d6636d813b)\nPackage hides a code downloading and installing an infostealer.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-chromacli\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - malware\n\n\n - infostealer\n\n\n - action-hidden-in-lib-usage\n","affected":[{"package":{"name":"supercolor-tui","ecosystem":"PyPI","purl":"pkg:pypi/supercolor-tui"},"versions":["0.1.0","0.1.1","0.1.2","0.1.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["supercolor_tui-0.1.0.tar.gz","supercolor_tui-0.1.0-py3-none-any.whl"],"path":"src/supercolor_tui/core.py","sha256":"13d8380fb861a6e547f2e04ce0a280ba18bc22899fb9ed6f5671a70cc6164b01","tlsh":"16718512d8499052e383c87489a289632b6ebc4359af18347dacc3b87f4e13dc1f88dd"}],"package_integrity":[{"filename":"supercolor_tui-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"d20746a38bf3d3148a9607e721ba684d939913135f78cd208e02aeadecfc57a0","md5":"a1e4b1bc0c017d2bb9219f1ea18add2d","sha256":"a96c14c252952fa40cd0c0cf895ece4c779f97eebbbc076d6e136b846fdf89c4"}},{"filename":"supercolor_tui-0.1.0.tar.gz","hashes":{"blake2b_256":"2f5bc661bc0f4ed794c111e2a172b817dfd51782851a744e224cfe7c2e13b08b","md5":"51de8ed46b81478ac621e496735617fd","sha256":"be1f53bbbd5893c9899d048a433f8c9b1a8f921dde3ff54f1cc146227c1aab09"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/supercolor-tui/MAL-2026-18767.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/supercolor-tui"},{"type":"PACKAGE","url":"https://pypi.org/project/supercolor-tui/0.1.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/supercolor-tui/0.1.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/supercolor-tui/0.1.2/"}],"database_specific":{"iocs":{"urls":["https://cdn.discordapp.com/attachments/1560347732839891076/1562446203021566032/bedwars.exe?ex=6af1172b&is=6aefc5ab&hm=544b5aacd95a3a0cba1db54a7e7adba093e4b68b8e37c9ec7af805e8fc5e960b&","https://store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe"]},"malicious-packages-origins":[{"id":"pypi/2026-11-chromacli/supercolor-tui","import_time":"2026-11-08T12:15:16.077421291Z","modified_time":"2026-11-08T11:33:17.456393Z","sha256":"9798fa32337256d29d4b551193b6aa6817601034ce787bae4d09d7d6636d813b","source":"kam193","versions":["0.1.0","0.1.1","0.1.2","0.1.4"]},{"id":"pypi/2026-11-chromacli/supercolor-tui","import_time":"2026-11-08T13:10:25.214672442Z","modified_time":"2026-11-08T11:33:17.456393Z","sha256":"0cdf2ba66c33faabd6be6ed36062fb33456f54ff97a408af930eee82f66ba3a2","source":"kam193","versions":["0.1.0","0.1.1","0.1.2","0.1.4"]},{"id":"IN-MAL-2026-022596","import_time":"2026-11-11T21:05:22.685269204Z","modified_time":"2026-11-11T20:51:34Z","sha256":"54bb239a687410bb8a21d1dfb212f9b959a0ca9d6643f381fe9a4272c64e0080","source":"amazon-inspector","versions":["0.1.0"]},{"id":"IN-MAL-2026-022594","import_time":"2026-11-11T21:05:22.559959668Z","modified_time":"2026-11-11T20:51:18Z","sha256":"9505cdfb58ccf88da6eb5f64f02c194dbfbf1f149f1bde76118d8cab52a6760b","source":"amazon-inspector","versions":["0.1.1"]},{"id":"IN-MAL-2026-022593","import_time":"2026-11-11T21:05:22.492247329Z","modified_time":"2026-11-11T20:51:11Z","sha256":"fe58236d0674212cad2f637a7ed666e55bc47495d11f959b7b11e6f5f029b44a","source":"amazon-inspector","versions":["0.1.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} |