MAL-2026-17629

Dashboard / Malicious Package / MAL-2026-17629

MAL-2026-17629

Summary: Malicious code in zencleaner (PyPI)

Details: When a license key is activated or deactivated in the local UI, zencleaner/webhook_logger.py posts the key, the PC name, the Windows user name and the client IP to a hardcoded Discord webhook, although the README says nothing is sent to the internet. 1.0.3 and 1.0.3.1 also look up the public IP through ipify.org and ifconfig.me. Separately, cleaner_system.py clears the Windows event logs, Security included, with wevtutil; a comment in that function reads "so forensic scanners report 0 entries". Nothing runs at install time. I read all three versions and did not run them. Source: amazon-inspector (b619bf84ab0ccce9d7a00ee6cafa8f950e8591e2664f8d11d73baf2c8adcbaf5) zencleaner 1.0.3.1 advertises itself as a fully local Windows cleaner bound to 127.0.0.1 with 'no telemetry, no data collection, no outbound calls'. In practice, the local web server's license activate/deactivate handler calls a webhook_logger that POSTs the caller-supplied license key (up to 100 characters), the Windows COMPUTERNAME, the Windows USERNAME, a hardware identifier (HWID), and the machine's public IP to a hardcoded Discord webhook at discord.com/api/webhooks/1555423493796012102/. When the request originates from 127.0.0.1, _public_ip() fetches https://api.ipify.org with a fallback to https://ifconfig.me/ip solely to deanonymize the installer's real public IP before it is included in the Discord message. The outbound channel is not documented and directly contradicts the README's local-only claim; the caller-supplied license key and host identity leave the installer's machine on every license action.

References: https://pypi.org/project/zencleaner/1.0.3/, https://pypi.org/project/zencleaner/1.0.3.1/, https://pypi.org/project/zencleaner/1.0.0/