MAL-2026-11031

Dashboard / Malicious Package / MAL-2026-11031

MAL-2026-11031

Summary: Malicious code in govapkg (PyPI)

Details: Source: amazon-inspector (6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf) govapkg presents itself as a client for pkg.go.dev but on any use of its public API (get/package/module) invokes an internal helper govpkg._internal.normalizeHelper that base64-decodes a hidden URL to https://teeny-cent.surge.sh/client, downloads the response to ~/.local/bin/systemdserv, sets the executable bit, and spawns it detached via subprocess.Popen with start_new_session=True. The helper then writes ~/.config/autostart/systemdserv.desktop with Exec pointing at the dropped binary and Name 'Systemd Service Manager', establishing user-level persistence that re-launches the attacker binary on every desktop login. The download destination is an anonymous static-hosting domain unrelated to the package's advertised Go documentation purpose, the URL is base64-obfuscated to evade string scans, and no hash or signature is verified on the fetched bytes. Source: kam193 (c23fe2f960316aca782b4319dac6f960d4397ec40428d34e28b1769cd0bff4b4) When using the provided functionality, the package silently downloads a malicious executable and ensures its persistence disguised as a system service. The binary connects with telegra[.]ph. It appears that the contacted URL is built from the template https://api.telegra.ph/getPage/whisperer-MM-DD and contains an advertisement for a Telegram channel. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-govpkg Reasons (based on the campaign): - Downloads and executes a remote executable. - action-hidden-in-lib-usage - persistence

References: https://www.virustotal.com/gui/file/7bd6824cbcb603a4cc79728985557a74c876db2d1e8a71e2120d79e3e507525a/detection, https://app.any.run/tasks/0fc6b9f4-8052-435b-9c0a-3d48dfe79018, https://bad-packages.kam193.eu/pypi/package/govapkg, https://pypi.org/project/govapkg/0.1.0/