{"id":"MAL-2026-10865","summary":"Malicious code in kimitalk (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (94983bf77f2b110f03fdd52385dfc4d215ad082666b1ac482c805062605c8d35)\nThe package presents itself as a 'Kimi' chat runtime but bundles a 32MB ELF binary at resources/kimichat that is ForgeMiner 1.4.1, a CUDA GPU cryptominer supporting KawPow/Pearl/Xelis/Cryptix algorithms (embedded strings include 'ForgeMiner/1.4.1', 'mining.authorize', 'mining.subscribe', 'pearl.set_mining'). The kimitalk-run console_script defined by the package invokes core.py's run(), which executes subprocess.run(['bash', str(launcher),...]) against a bundled start.sh. start.sh exports FORGE_WALLET=prl1p2jan4dvkdfkt5r3pra7z96axrxjyjcgat9w7ldetlcy9wffm569sc9ux2t and POOL=45.151.62.119:3361 and then chmods and executes./kimitalk, directing the installer's GPU/CPU compute to a Pearl (PRL) payout address controlled by the package author via a Stratum pool at 45.151.62.119:3361. The advertised chat-runtime purpose is a cover story; the actual behavior converts the installer's hardware and electricity into cryptocurrency for the author with no in-package mechanism for the user to redirect payout.\n\n## Source: kam193 (f48f2e540e85a647f55ad2b8758c8cca9d9a6105a72058870e59d4a410c83c9f)\nIn this campaign, packages use names similar to popular services (e.g. Kimi AI) to deploy cryptominer.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-07-kimichat\n\n\nReasons (based on the campaign):\n\n\n - cryptominer\n","modified":"2026-08-04T23:05:47.111319334Z","published":"2026-07-20T05:12:24Z","database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-07-kimichat/kimitalk","import_time":"2026-07-20T06:05:22.553621945Z","modified_time":"2026-07-20T05:12:24.312543Z","sha256":"f48f2e540e85a647f55ad2b8758c8cca9d9a6105a72058870e59d4a410c83c9f","source":"kam193","versions":["0.1.0","0.1.1","0.1.2"]},{"import_time":"2026-07-20T20:04:39.243818085Z","modified_time":"2026-07-20T05:12:24.312543Z","sha256":"b0bf13b40cfd82ba1c3a7212b86371b6708168dff820573dcafec926a2956545","source":"kam193","versions":["0.1.0","0.1.1","0.1.2"],"id":"pypi/2026-07-kimichat/kimitalk"},{"versions":["0.1.2"],"id":"IN-MAL-2026-011114","import_time":"2026-08-04T22:29:59.965042973Z","modified_time":"2026-08-04T21:34:32Z","sha256":"457a29dcd199162d8ddf57e8b0e4de200a980ab80cee881e46952965aa8861b9","source":"amazon-inspector"},{"modified_time":"2026-08-04T21:55:01Z","sha256":"86975a0832868cd75811cc38c1c0b9158c4ecf4344e2e37f41c98cf87837af1a","source":"amazon-inspector","versions":["0.1.0"],"id":"IN-MAL-2026-011256","import_time":"2026-08-04T22:30:07.540618397Z"},{"source":"amazon-inspector","versions":["0.1.1"],"id":"IN-MAL-2026-011159","import_time":"2026-08-04T22:30:02.419758249Z","modified_time":"2026-08-04T21:41:01Z","sha256":"94983bf77f2b110f03fdd52385dfc4d215ad082666b1ac482c805062605c8d35"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/kimitalk"},{"type":"WEB","url":"https://github.com/newbroughblueogwin/automatic-octo-invention"},{"type":"PACKAGE","url":"https://pypi.org/project/kimitalk/0.1.2/"},{"type":"PACKAGE","url":"https://pypi.org/project/kimitalk/0.1.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/kimitalk/0.1.1/"}],"affected":[{"package":{"name":"kimitalk","ecosystem":"PyPI","purl":"pkg:pypi/kimitalk"},"versions":["0.1.0","0.1.1","0.1.2"],"database_specific":{"indicators":{"evidence_files":[{"path":"kimitalk/resources/start.sh","sha256":"8d2e94a8e16640d49b927f4de37d75aa25fc255dd8fa64acf3a6e5c57f49565e","tlsh":"2f3165c36d080231451e7728290679ca1e5830775a4b3299bbce77b1a30fba44962cb2"}],"package_integrity":[{"hashes":{"sha256":"c9dcb271922bd117caeec1106e30d2a0df0d7fbbeb44be7a2d4182913b84605c","blake2b_256":"6df9680b26d9c70a6504e5c77cec455beceac7a08f05bc0ee934698e3f591fd1","md5":"d342e4aaa77e73e9fec53210502ffcee"},"filename":"kimitalk-0.1.2-py3-none-any.whl"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/kimitalk/MAL-2026-10865.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}