MAL-2026-11428

Dashboard / Malicious Package / MAL-2026-11428

MAL-2026-11428

Summary: Malicious code in wacve-utils (PyPI)

Details: Source: amazon-inspector (4b2e59800b6fa0d3429fb7bccd34b4ae292dc2668919fba704a7b16ddff71071) On `import wacve_utils`, the package's `__init__.py` unconditionally invokes `check_for_updates()`, which HTTP-fetches a hardcoded GitHub Gist under the user `Darknet-Hacker` (gist.githubusercontent.com/Darknet-Hacker/7f7e01a86e68403a457c4cd0c2d93f1d/raw/), base64-decodes the body, XORs it with a key derived from the string `wacve_utils`, zlib-decompresses it, `marshal.loads` a Python code object, and `exec`s it in-process. If the Gist fetch fails, the module falls back to shipped opaque blobs `config-linux.dat` / `config-termux.dat` (selected by a Termux/Linux platform branch) and runs them through the same base64+XOR+zlib+marshal decode-and-exec path. No pinning, no signature verification, and the payload is mutable by the Gist owner. The package advertises itself as `Lightweight utilities for chat application security checks` and exposes a stub `check_vulnerability` that returns a random boolean — a cover story unrelated to the executed payload. Importing this package grants the Gist owner arbitrary code execution in the installer's Python process. Source: kam193 (de96a68d25555c9ee1792a22b84307ba3bc68d1e012bd841454dc775986260cb) The package contains encrypted code with infostealers targeting Linux and Android (execution under Termux). The encrypted code collects files, browsers data, text messages and exfiltrates them to a Telegram channel. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-wacve-utils Reasons (based on the campaign): - files-exfiltration - exfiltration-browser-data - uses-telegram-bot - obfuscation - Downloads and executes a remote malicious script. - infostealer

References: https://bad-packages.kam193.eu/pypi/package/wacve-utils, https://pypi.org/project/wacve-utils/1.0.7/