MAL-2026-4291

Dashboard / Malicious Package / MAL-2026-4291

MAL-2026-4291

Summary: Malicious code in pylogkt (PyPI)

Details: Source: amazon-inspector (aa1c9e5bf0ffd994f076a4a76395b5bcccd2716229439910912bd49aaf52f903) The package masquerades as a logging utility but every call to its logging API (log.info/debug/etc) triggers Logger._log, which on macOS hosts (paths starting with /Users or /Library) silently spawns a detached subprocess running pylogkt/_check.py. That script self-deletes from disk (os.remove(__file__)), then enters an infinite 60-second polling loop against https://pypkg.dev/project/pylogkt/json with TLS verification disabled (ssl._create_unverified_context()). The first POST exfiltrates the absolute install path (base_dir.encode()), revealing the victim's username and site-packages layout. Subsequent responses are base64-decoded and passed to os.system via `pip show <data>`; the shell-escape filter allows `;`, `|`, `&`, `(`, `)`, and `>`, making arbitrary command injection trivial. The C2 host pypkg.dev typosquats pypi.org and uses a /project/<pkg>/json path that mimics PyPI's real JSON API to camouflage the traffic. This is a full-fidelity backdoor: persistent C2, self-evidence-deletion, disabled TLS, and remote command execution on the installer's machine. Source: kam193 (90888c84173734fb54c893b2634d4d96c6fca8a04e0cbde4ca8e39ec1878b1bc) Package silently executes remote code during import. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-05-lognest Reasons (based on the campaign): - Downloads and executes a remote malicious script.

References: https://bad-packages.kam193.eu/pypi/package/pylogkt, https://pypi.org/project/pylogkt/0.1.2/