{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "setup.py",
              "sha256": "e3e6401df3a293e4d7511661d7a71b6f6dace4b74bc9dd394c01647ae3848313",
              "tlsh": "a8316207e0bf29291ec354a0558f03959bc0e3a32f6431fa71fc29191f0b129503b8af"
            }
          ],
          "package_integrity": [
            {
              "filename": "toorc-0.0.1-py3-none-any.whl",
              "hashes": {
                "blake2b_256": "8bffdd9a7245f0f8e1b80d434a0432079bd32d9e055a6e3472014d3eeaa593e9",
                "md5": "87b8e80085e5c76fce43e6ee293a583d",
                "sha256": "c8ead1ac2162b136fe0babfc1f6f34f4e3d9f499fc3f808e17db9ecf55e1ba5e"
              }
            },
            {
              "filename": "toorc-0.0.1.tar.gz",
              "hashes": {
                "blake2b_256": "3d0684e0af55f5e3ccf134f7fe1d2efed1369b8085f3ec68077daa0c3a2ef65b",
                "md5": "2aea2d99b8acf3bf0a5734cbd7f77e84",
                "sha256": "aa94fe4ea2cab90497da15cd24b5c24be34a29d8b7b1ae1cb5efbb2091f843d2"
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "toorc"
      },
      "versions": [
        "0.0.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)",
      "type": "REPORTER"
    }
  ],
  "database_specific": {
    "iocs": {
      "domains": [
        "gjampdwmdjmppwedtkpbbdkq05f6iiz6r.oast.fun"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "pypi/2026-06-ip-rotat/toorc",
        "import_time": "2026-06-23T13:28:20.42407085Z",
        "modified_time": "2026-06-23T12:07:57.927156Z",
        "sha256": "f9b8be8a4e20e24b88630f331f4bdd7bc66e208558ece25843aecc7a8110b4b4",
        "source": "kam193",
        "versions": [
          "0.0.1"
        ]
      },
      {
        "id": "IN-MAL-2026-007334",
        "import_time": "2026-06-23T19:40:40.275534309Z",
        "modified_time": "2026-06-23T18:58:00Z",
        "sha256": "2cfd36909e089f17439dd3227c6f5ccef2fef2964dc26bbdbaaef0481b54615d",
        "source": "amazon-inspector",
        "versions": [
          "0.0.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2cfd36909e089f17439dd3227c6f5ccef2fef2964dc26bbdbaaef0481b54615d)\nOn `pip install` (and even `pip download`), the package\u0027s setup.py overrides the `install` and `egg_info` commands to execute a RunCommand() routine that serializes every entry in `os.environ` into a key=value query string and captures the output of `ps -elf`. The combined payload is then POSTed via curl over plaintext HTTP to `http://gjampdwmdjmppwedtkpbbdkq05f6iiz6r.oast.fun`, a unique subdomain on the public interactsh out-of-band testing service. Any CI/build secrets present in the environment at install time (AWS_*, GITHUB_TOKEN, NPM_TOKEN, CI provider tokens, etc.) leak to the attacker-controlled OAST listener, along with a snapshot of running processes on the host.\n\n## Source: kam193 (f9b8be8a4e20e24b88630f331f4bdd7bc66e208558ece25843aecc7a8110b4b4)\nDuring installation, the package exfiltrates env variables\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-06-ip-rotat\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - exfiltration-env-variables\n",
  "id": "MAL-2026-6290",
  "modified": "2026-06-23T19:42:43Z",
  "published": "2026-06-23T12:07:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/toorc"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/toorc/0.0.1/"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in toorc (PyPI)"
}