MAL-2026-10868

Dashboard / Malicious Package / MAL-2026-10868

MAL-2026-10868

Summary: Malicious code in neroteam-v1 (PyPI)

Details: Source: amazon-inspector (e8a87642ea3c7a291704b2306a242bb496048571efcafb63835055f0871aed19) Importing the `nero` package triggers `nero/__init__.py` to load `nero.main`, whose top-level code runs a `_guard()` routine before executing a hidden payload. `_guard()` performs anti-debug checks (`sys.gettrace`, `sys.settrace(None)`, `_getframe().f_trace`), timing checks, and substring matching against sandbox/VM indicators (`sandbox`, `virtualbox`, `vmware`, `qemu`, `wine`, `hyperv`, `xen`) in PATH, the Python executable path, and processor identifiers. It then base64-decodes a ~110KB blob, decrypts it with a custom RC4-like keystream cipher keyed by the string `Cxdgs`, and passes the plaintext to `exec()`. The decrypted code is opaque and only reachable on machines that pass the anti-analysis gauntlet. The combination of import-time `exec` of a custom-encrypted blob with dedicated anti-VM and anti-debug evasion is inconsistent with the package's stated 'account generator' purpose and matches the shape of hostile install/import-time code execution against the installer's host. Source: kam193 (458a2993d1a429a687102ddfca3f9fc0c91f72373b07ccad6ff83fb56add7e58) Obfuscated code is used to abuse systems of garena[.]com for mass account generation, bypassing their security systems. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-neroteam-v1 Reasons (based on the campaign): - obfuscation - abusing-3rd-api - The package contains code to detect if it is running in a sandbox environment.

References: https://bad-packages.kam193.eu/pypi/package/neroteam-v1, https://pypi.org/project/neroteam-v1/1.0.6/, https://pypi.org/project/neroteam-v1/1.0.5/, https://pypi.org/project/neroteam-v1/1.0.4/, https://pypi.org/project/neroteam-v1/1.0.7/, https://pypi.org/project/neroteam-v1/1.0.1/, https://pypi.org/project/neroteam-v1/1.0.2/, https://pypi.org/project/neroteam-v1/1.0.0/, https://pypi.org/project/neroteam-v1/1.0.3/