MAL-2026-10916

Dashboard / Malicious Package / MAL-2026-10916

MAL-2026-10916

Summary: Malicious code in python-devplatform-client (PyPI)

Details: Source: amazon-inspector (8daa66fc6fa92869318e5a544d82fab2d5dff870dc4c6784f28733f84441415a) The package's setup.py copies a telemetry.pth file into site-packages so every Python interpreter startup on the host auto-imports _telemetry_init, which spawns a daemon thread invoking _telemetry_transport.Client.initialize(). That client selects a platform-keyed asset path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) from a list of anonymous Cloudflare Workers mirrors (package-proxy.cf5oobworker.workers.dev, cf8oobworker/cf12oobworker/cf17-ddb/cf25-6eb.workers.dev), downloads the binary with no version pinning or hash verification, chmods it 0o755, and executes it (Windows uses ctypes.windll.kernel32 CreateProcess). A fallback ServiceDiscovery routine opens raw UDP sockets to 8.8.8.8/1.1.1.1 and issues TXT lookups against tin/tina/ldr/win.dl.well1.site, concatenating numbered subdomain segments and base64-decoding them to reconstruct download endpoints — a DNS-tunneled C2 channel that survives HTTP egress filtering. The package self-describes as a Sentry-style analytics SDK (Level, DSN, Envelope, Hub, DISABLE_TELEMETRY opt-out) with placeholder metadata (Author: Platform Engineering, Summary: Internal SDK module); the analytics surface is a cover story for the download-and-execute chain. The.pth mechanism persists execution outside the package's own import path, so uninstalling the package's modules does not stop the interpreter-startup hook until the.pth file itself is removed from site-packages. Source: kam193 (2b75d4d8e3c822aa82b716e6752c0901447845d442973ce9bc35c78b9c81c78a) Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from one of c.*.dl.well1[.]site domains, depending on the system. This record returns a number, which is then used to iterate over domains in the form <0...n>.*.dl.well1[.]site and reconstruct the encoded executable from their TXT records. The downloaded binary is then executed and removed afterward. Using a PTH file ensures persistence and runs on every Python start. In this campaign, versions 0.0.1 hold disarmed code (without the necessary configuration), which is completed in further updates. This is a continuation of the 2026-07-haproxy-config-client campaign. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-andreiiiiiii_i Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation. - Downloads and executes a remote executable. - covering-tracks - persistence - abuses-pth - data-stored-in-dns

References: https://bad-packages.kam193.eu/pypi/package/python-devplatform-client, https://www.virustotal.com/gui/file/06f1c2f0c66cf13ab6702414e8dce7c4115939f3e9cf95e9a8baade58961c016/detection, https://www.virustotal.com/gui/file/230f81f18608800912def92e18999874e004cd9fb4a554f759f77e4dd2030081/detection, https://www.virustotal.com/gui/file/c98444d6aebfd87f2f4412e1d7aafe8fe3fe080139ca1111049ea83fe828cd1d/detection, https://www.virustotal.com/gui/file/1360bb7437f5e7790747bc4e31eedcd19f88f23b20362a42368f4179b8b9e27d/detection, https://tria.ge/260720-teqmlshs6y/behavioral1, https://pypi.org/project/python-devplatform-client/8.5.3/, https://pypi.org/project/python-devplatform-client/8.5.4/, https://pypi.org/project/python-devplatform-client/0.0.1/