MAL-2026-10756

    Dashboard / Malicious Package / MAL-2026-10756

    MAL-2026-10756

    Published: 16 Jul 2026Last Modified: 23 Jul 2026

    Summary: Malicious code in darkglitch (PyPI)

    Details: Source: amazon-inspector (5a84fec55fc625d5e2b337aafe5a9a95ff30c47403241c59dbb33543ec97311a) The package installs a listener CLI (`darkglitch -l -b`) that opens a WebSocket to the hardcoded signaling host malware-signal.vercel.app and joins the hardcoded room D4RKGLI7CH (core/data/client.py: HOST/ROOM constants). Incoming `remote-command` messages are executed on the host via subprocess.run(command, shell=True, capture_output=True,...) inside _process_command_request, with stdout/stderr returned to the sender. transfer_utils/transfer.py extends this channel with arbitrary file upload/download: build_transfer_command emits a python3 heredoc that base64-encodes any source path's bytes for exfiltration, and the upload branch base64-decodes attacker-supplied bytes to any target path. The README instructs users to build the listener as darkglitch_listener.exe with PyInstaller's --noconsole flag so no window appears, and internal modules (malware_signal, injection_utils, helper.py) describe themselves as a "post-exploitation framework" and "Advanced Command & Control Framework". The room identifier is shared, so any party who knows it can issue commands to any host running the listener.

    References: https://pypi.org/project/darkglitch/1.2.0/, https://pypi.org/project/darkglitch/1.2.9/

    Affected packages

    Package

    Name: darkglitch

    Purl: pkg:pypi/darkglitch

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.2.0
    1.2.9