MAL-2026-10916
Vulnerability from ossf_malicious_packages
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (8daa66fc6fa92869318e5a544d82fab2d5dff870dc4c6784f28733f84441415a)
The package's setup.py copies a telemetry.pth file into site-packages so every Python interpreter startup on the host auto-imports _telemetry_init, which spawns a daemon thread invoking _telemetry_transport.Client.initialize(). That client selects a platform-keyed asset path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) from a list of anonymous Cloudflare Workers mirrors (package-proxy.cf5oobworker.workers.dev, cf8oobworker/cf12oobworker/cf17-ddb/cf25-6eb.workers.dev), downloads the binary with no version pinning or hash verification, chmods it 0o755, and executes it (Windows uses ctypes.windll.kernel32 CreateProcess). A fallback ServiceDiscovery routine opens raw UDP sockets to 8.8.8.8/1.1.1.1 and issues TXT lookups against tin/tina/ldr/win.dl.well1.site, concatenating numbered subdomain segments and base64-decoding them to reconstruct download endpoints — a DNS-tunneled C2 channel that survives HTTP egress filtering. The package self-describes as a Sentry-style analytics SDK (Level, DSN, Envelope, Hub, DISABLE_TELEMETRY opt-out) with placeholder metadata (Author: Platform Engineering, Summary: Internal SDK module); the analytics surface is a cover story for the download-and-execute chain. The.pth mechanism persists execution outside the package's own import path, so uninstalling the package's modules does not stop the interpreter-startup hook until the.pth file itself is removed from site-packages.
Source: kam193 (2b75d4d8e3c822aa82b716e6752c0901447845d442973ce9bc35c78b9c81c78a)
Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from one of c..dl.well1[.]site domains, depending on the system. This record returns a number, which is then used to iterate over domains in the form <0...n>..dl.well1[.]site and reconstruct the encoded executable from their TXT records. The downloaded binary is then executed and removed afterward. Using a PTH file ensures persistence and runs on every Python start. In this campaign, versions 0.0.1 hold disarmed code (without the necessary configuration), which is completed in further updates.
This is a continuation of the 2026-07-haproxy-config-client campaign.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-07-andreiiiiiii_i
Reasons (based on the campaign):
-
The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
-
The package overrides the install command in setup.py to execute malicious code during installation.
-
Downloads and executes a remote executable.
-
covering-tracks
-
persistence
-
abuses-pth
-
data-stored-in-dns
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "_telemetry_init.py",
"sha256": "ca829c0a64e5aae78bc2e93aeb6897b5b3a4b0b60d2266ef1ffca4aed68ed532",
"tlsh": "b6d1a627ed151d72c547e3a698a6d1a1e32b59132e907078bddc831c1f8822782ff5bd"
},
{
"path": "_telemetry_transport.py",
"sha256": "d93b3cc1b6425b5af5d7d3820010fc1672c6dc25958f7394ebb2827863ad7b2f",
"tlsh": "7ab351a6e42a6c62c247d82a4c97f143772f6c53160c64787dfc825c2f59729c2f6ee8"
},
{
"path": "PKG-INFO",
"sha256": "37370825619f814f8389ef9352ccdd45928f8b282db988265b678842133344f9",
"tlsh": "b311ab241ad2d93576f3060b6982c2b7c1728691298bb04cb8f303dd8a69d98c77e33d"
}
],
"package_integrity": [
{
"filename": "python_devplatform_client-8.5.3.tar.gz",
"hashes": {
"blake2b_256": "5372698bea5a418fbb54ef83d5d8a1c00ceda1d321770012ac65c1d9ce6a31e7",
"md5": "c3ce1c6ea0946287efb03602c6e0b747",
"sha256": "cf3c369ebc1c0298a03ed9a00d2a7eb74dbbd2e67dd7efbca6766eb2c8046778"
}
}
]
}
},
"package": {
"ecosystem": "PyPI",
"name": "python-devplatform-client"
},
"versions": [
"0.0.1",
"8.5.3",
"8.5.4"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
},
{
"contact": [
"https://github.com/kam193",
"https://bad-packages.kam193.eu/"
],
"name": "Kamil Ma\u0144kowski (kam193)",
"type": "REPORTER"
},
{
"contact": [
"https://github.com/kam193",
"https://bad-packages.kam193.eu/"
],
"name": "Kamil Ma\u0144kowski (kam193)",
"type": "ANALYST"
}
],
"database_specific": {
"iocs": {
"domains": [
"package-proxy.cf8oobworker.workers.dev",
"package-proxy.cf5oobworker.workers.dev",
"package-proxy.cf25-6eb.workers.dev",
"package-proxy.cf17-ddb.workers.dev",
"win.dl.well1.site",
"tina.dl.well1.site",
"tin.dl.well1.site",
"ldr.dl.well1.site"
]
},
"malicious-packages-origins": [
{
"id": "pypi/2026-07-andreiiiiiii_i/python-devplatform-client",
"import_time": "2026-07-20T16:06:06.877551373Z",
"modified_time": "2026-07-20T14:11:29.731509Z",
"sha256": "00edd685ee9e9d7b4bab294f11c583434d683b963af5df00fbb1c4eb6df176e0",
"source": "kam193",
"versions": [
"0.0.1",
"8.5.3",
"8.5.4"
]
},
{
"id": "pypi/2026-07-andreiiiiiii_i/python-devplatform-client",
"import_time": "2026-07-20T17:01:49.035133256Z",
"modified_time": "2026-07-20T14:11:29.731509Z",
"sha256": "2b75d4d8e3c822aa82b716e6752c0901447845d442973ce9bc35c78b9c81c78a",
"source": "kam193",
"versions": [
"0.0.1",
"8.5.3",
"8.5.4"
]
},
{
"id": "IN-MAL-2026-010997",
"import_time": "2026-08-04T21:33:12.871719792Z",
"modified_time": "2026-08-04T21:17:22Z",
"sha256": "6d5a2ab0ca1218bc9891e144175e097c4971783defbb7dbfc5effe0aacb4a4f0",
"source": "amazon-inspector",
"versions": [
"8.5.3"
]
},
{
"id": "IN-MAL-2026-010996",
"import_time": "2026-08-04T21:33:12.827203784Z",
"modified_time": "2026-08-04T21:17:13Z",
"sha256": "8daa66fc6fa92869318e5a544d82fab2d5dff870dc4c6784f28733f84441415a",
"source": "amazon-inspector",
"versions": [
"8.5.4"
]
},
{
"id": "IN-MAL-2026-013387",
"import_time": "2026-08-05T07:06:44.935903038Z",
"modified_time": "2026-08-05T06:15:52Z",
"sha256": "f0ce9b74244d2517ccba2c761ce516e374def55d30df80d4ec108b9fbfe7a5c1",
"source": "amazon-inspector",
"versions": [
"0.0.1"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8daa66fc6fa92869318e5a544d82fab2d5dff870dc4c6784f28733f84441415a)\nThe package\u0027s setup.py copies a telemetry.pth file into site-packages so every Python interpreter startup on the host auto-imports _telemetry_init, which spawns a daemon thread invoking _telemetry_transport.Client.initialize(). That client selects a platform-keyed asset path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) from a list of anonymous Cloudflare Workers mirrors (package-proxy.cf5oobworker.workers.dev, cf8oobworker/cf12oobworker/cf17-ddb/cf25-6eb.workers.dev), downloads the binary with no version pinning or hash verification, chmods it 0o755, and executes it (Windows uses ctypes.windll.kernel32 CreateProcess). A fallback ServiceDiscovery routine opens raw UDP sockets to 8.8.8.8/1.1.1.1 and issues TXT lookups against tin/tina/ldr/win.dl.well1.site, concatenating numbered subdomain segments and base64-decoding them to reconstruct download endpoints \u2014 a DNS-tunneled C2 channel that survives HTTP egress filtering. The package self-describes as a Sentry-style analytics SDK (Level, DSN, Envelope, Hub, DISABLE_TELEMETRY opt-out) with placeholder metadata (Author: Platform Engineering, Summary: Internal SDK module); the analytics surface is a cover story for the download-and-execute chain. The.pth mechanism persists execution outside the package\u0027s own import path, so uninstalling the package\u0027s modules does not stop the interpreter-startup hook until the.pth file itself is removed from site-packages.\n\n## Source: kam193 (2b75d4d8e3c822aa82b716e6752c0901447845d442973ce9bc35c78b9c81c78a)\nPackage presents little functionality, but excessive fake \u0027telemetry\u0027 module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it\u0027s not successful, the code falls back to download using DNS: first, it gets a TXT record from one of c.*.dl.well1[.]site domains, depending on the system. This record returns a number, which is then used to iterate over domains in the form \u003c0...n\u003e.*.dl.well1[.]site and reconstruct the encoded executable from their TXT records. The downloaded binary is then executed and removed afterward. Using a PTH file ensures persistence and runs on every Python start. In this campaign, versions 0.0.1 hold disarmed code (without the necessary configuration), which is completed in further updates.\n\nThis is a continuation of the 2026-07-haproxy-config-client campaign.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-07-andreiiiiiii_i\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - Downloads and executes a remote executable.\n\n\n - covering-tracks\n\n\n - persistence\n\n\n - abuses-pth\n\n\n - data-stored-in-dns\n",
"id": "MAL-2026-10916",
"modified": "2026-08-05T07:08:57.377840699Z",
"published": "2026-07-18T14:13:52Z",
"references": [
{
"type": "WEB",
"url": "https://bad-packages.kam193.eu/pypi/package/python-devplatform-client"
},
{
"type": "EVIDENCE",
"url": "https://www.virustotal.com/gui/file/06f1c2f0c66cf13ab6702414e8dce7c4115939f3e9cf95e9a8baade58961c016/detection"
},
{
"type": "EVIDENCE",
"url": "https://www.virustotal.com/gui/file/230f81f18608800912def92e18999874e004cd9fb4a554f759f77e4dd2030081/detection"
},
{
"type": "EVIDENCE",
"url": "https://www.virustotal.com/gui/file/c98444d6aebfd87f2f4412e1d7aafe8fe3fe080139ca1111049ea83fe828cd1d/detection"
},
{
"type": "EVIDENCE",
"url": "https://www.virustotal.com/gui/file/1360bb7437f5e7790747bc4e31eedcd19f88f23b20362a42368f4179b8b9e27d/detection"
},
{
"type": "EVIDENCE",
"url": "https://tria.ge/260720-teqmlshs6y/behavioral1"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/python-devplatform-client/8.5.3/"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/python-devplatform-client/8.5.4/"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/python-devplatform-client/0.0.1/"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in python-devplatform-client (PyPI)"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.