MAL-2026-10978

Dashboard / Malicious Package / MAL-2026-10978

MAL-2026-10978

Summary: Malicious code in reimagined-broccoli (PyPI)

Details: Source: amazon-inspector (70b417d0787324aa952fe69c59b47f6bea108ab02fd20241a6597c2ee0e6f3d8) The package `reimagined-broccoli` ships a benign-looking stub at `reimagined_broccoli/main.py` that only prints a success message. The tarball also ships `redis.zip` (declared in MANIFEST.in), which contains a second `main.py`, an opaque native ELF `redis.so`, and a `.env`. The package exposes a single console-script `reimagined-broccoli` whose entry point runs `start.sh`, which executes `unzip -o "$SCRIPT_DIR/redis.zip"` — overwriting the shipped stub — and then `python3 "$SCRIPT_DIR/main.py"`, invoking the extracted payload alongside `redis.so`. There is no hash or signature verification of the archive contents. The package metadata is placeholder (`Your Name`, an auto-generated repository slug) and the file name `redis.so` does not correspond to the Redis project. The visible Python source is a decoy; the code actually executed on CLI invocation is the opaque bundled binary/script pair inside the archive. This is the extract-overwrite-execute dropper shape carrying an unverifiable native payload from a placeholder-author publisher. Source: kam193 (f49aaf5b1b6388b52d7afd99359db7630e272770abd123c0cfc9977c0467b78d) In this campaign, packages use names similar to popular services (e.g. Kimi AI) to deploy cryptominer. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-kimichat Reasons (based on the campaign): - cryptominer

References: https://github.com/newbroughblueogwin/automatic-octo-invention, https://bad-packages.kam193.eu/pypi/package/reimagined-broccoli, https://pypi.org/project/reimagined-broccoli/0.1.0/