{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "domains": [
            "storage.filebin.net"
          ],
          "evidence_files": [
            {
              "path": "setup.py",
              "sha256": "5d4bf30c6967d269a6ab169902074c7b8f409800162f543c45665f91137f45a0",
              "tlsh": "7431b5aece0010909382bd182e8389ad257bb123bb63e4e53d9c41503fc9295d3d355e"
            },
            {
              "path": "goodoltoulas/__init__.py",
              "sha256": "9057287e8115fadd6886e030f535cf50b2cb4fe19cdac9b9b3619424fb67eaf2",
              "tlsh": "c0e0c0a72c217137ff0989684f1167565da63d33140a6070349ce0733f415108d300ca"
            }
          ],
          "package_integrity": [
            {
              "filename": "goodoltoulas-0.1.0-py3-none-any.whl",
              "hashes": {
                "blake2b_256": "47884f0279b1d41f0a75db7f9ba4d7d8ed6594a8dc99a89622f5e16a1514af14",
                "md5": "2429c6426cf2a0d433a75a4a43cf3a84",
                "sha256": "65008e17bddbd159ac4eda117d57ed9c43e043b0b7ddf02b8689da5f317b28f3"
              }
            },
            {
              "filename": "goodoltoulas-0.1.0.tar.gz",
              "hashes": {
                "blake2b_256": "586b62d969803ee06cb19040afb474334050b44312c94559092a77788d402c81",
                "md5": "5785a39f923578e1bc28c6505017f41d",
                "sha256": "61b77b654cede432d7bb4d1bdf7b8ecac07e9244c4a4090aa478704e74514a99"
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "goodoltoulas"
      },
      "versions": [
        "0.1.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)",
      "type": "REPORTER"
    }
  ],
  "database_specific": {
    "iocs": {
      "urls": [
        "https://cold-eu-par-1.gofile.io/download/web/deb39e07-da2d-4081-a86b-6380e555788c/main.exe"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "pypi/2026-06-goodoldtoulas/goodoltoulas",
        "import_time": "2026-06-05T20:11:44.760252838Z",
        "modified_time": "2026-06-05T19:06:35.125485Z",
        "sha256": "d1279e2d267bf2af95bf5c3a98cc71ac362ed2af7aa35f6bbfe1f05bb839cb18",
        "source": "kam193",
        "versions": [
          "0.1.0"
        ]
      },
      {
        "id": "IN-MAL-2026-006185",
        "import_time": "2026-06-12T19:44:17.608821008Z",
        "modified_time": "2026-06-12T19:10:50Z",
        "sha256": "98a84d10e07878c98ffa21b3920940b10ffac4d3cdd66250c046391ea502aaff",
        "source": "amazon-inspector",
        "versions": [
          "0.1.0"
        ]
      },
      {
        "id": "IN-MAL-2026-006186",
        "import_time": "2026-06-12T19:44:17.697615511Z",
        "modified_time": "2026-06-12T19:10:50Z",
        "sha256": "ee2ef27464f7f6b4aa1b5615a42ebd130e31cf169a4f3396656108d63a326b1b",
        "source": "amazon-inspector",
        "versions": [
          "0.1.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (98a84d10e07878c98ffa21b3920940b10ffac4d3cdd66250c046391ea502aaff)\nOn `pip install goodoltoulas`, setup.py unconditionally invokes setup_helper(), which downloads an opaque PE binary from an anonymous file-hosting service (storage.filebin.net) into C:\\MALWARE_DELETE\\main.exe and launches it via subprocess.Popen with CREATE_NEW_CONSOLE. There is no hash check, signature verification, or version pinning, and the host is unrelated to any package publisher. The library surface is a thin decoy: __init__.py forwards all attribute access to the `requests` module and the README advertises \u0027A simple request cloner for Python\u0027, providing cover for the install-time dropper. The drop path uses a self-incriminating directory name (C:\\MALWARE_DELETE) and the response carries application/vnd.microsoft.portable-executable, confirming hostile intent. Any Windows installer running `pip install` will execute attacker-controlled code immediately.\n\n## Source: kam193 (d1279e2d267bf2af95bf5c3a98cc71ac362ed2af7aa35f6bbfe1f05bb839cb18)\nDuring installation, package attempts to download and run an executable imitating malicious activity.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research \u0026 co, with clearly low-harm possibilities.\n\n\nCampaign: 2026-06-goodoldtoulas\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - Downloads and executes a remote executable.\n",
  "id": "MAL-2026-5272",
  "modified": "2026-06-12T19:46:18Z",
  "published": "2026-06-05T19:06:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/goodoltoulas"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/goodoltoulas/0.1.0/"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in goodoltoulas (PyPI)"
}