MAL-2026-4285

Dashboard / Malicious Package / MAL-2026-4285

MAL-2026-4285

Summary: Malicious code in polydata-analytics (PyPI)

Details: Source: amazon-inspector (04c2f2ae400ee7411678735073e22d4c662de5653a4add84eaca159ed0ba004a) Package self-describes as a Polymarket market-data analytics tool but ships a Windows clipboard monitor (src/polymarket_data_fetcher/_clipper/win_clip.py) that detects copied BTC/ETH/SOL/TRX/Polygon/BSC wallet addresses and silently overwrites them with attacker-controlled replacement addresses, redirecting cryptocurrency transfers to the attacker. The replacement address table and persistence configuration are stored as XOR-encrypted blobs (_W and _P) in src/polymarket_data_fetcher/_obf.py and decoded at runtime via eval() of a host-key-derived decryption, hiding the attacker wallets from static review. The package installs four redundant persistence vectors per platform: on Linux, ~/.config/autostart/data-fetcher.desktop, a user systemd service d-clipper-user.service, an appended background launcher line in ~/.bashrc/~/.profile, and an @reboot crontab entry; on Windows, an HKCU\...\Run\DataFetcher registry value, a Startup-folder shortcut, an sc-created DataService service when admin, and a schtasks /sc onlogon /rl highest scheduled task named DataUpdater; on macOS, a ~/Library/LaunchAgents/com.datafetcher.plist with RunAtLoad, Folder Actions registration, and an osascript-added login item named 'Data Sync'. Every malicious code path is gated by an anti-analysis check (src/polymarket_data_fetcher/_utils.py) that enumerates VBoxManage, VMware, VirtualBox, QEMU, Wireshark, IDA, OllyDbg, Process Hacker and aborts on sandbox-shaped usernames — characteristic malware shape, never present in legitimate analytics tooling. The advertised fetch_market_data() function is a thin wrapper around polymarket.com/gamma/markets and exists only as cover; __main__.py invokes _bg_services() and an infinite sleep loop, so running the bundled polydata-fetcher CLI launches the clipper and persistence in the background. Author metadata is placeholder ('Data Analytics Team <[email protected]>') with no real publisher identity. Source: kam193 (1b11035719acc6b849ae1ecc983db8841fd3676b4628ebcef0a24392d872eb5e) The code attempts to monitor the clipboard and replace copied cryptocurrency addresses, as well as establish persistence. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-05-polymarket-data-fetcher Reasons (based on the campaign): - peristence-autorun - obfuscation - crypto-related - The package contains code to detect if it is running in a sandbox environment. - clipboard-modify - persistence

References: https://bad-packages.kam193.eu/pypi/package/polydata-analytics, https://pypi.org/project/polydata-analytics/1.3.0/