{"id":"MAL-2026-10915","summary":"Malicious code in dwh-kafka-client (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (64f8759150fd0f4909a75613b1311c70c44b514bee2142ed4c67e0ef580afdbe)\nThe pypi package `dwh-kafka-client` 0.0.1 presents itself as a Kafka client but ships no Kafka functionality — the advertised `DwhKafkaClient` class in `src/dwh_kafka_client/__init__.py` is a placeholder with only `_opts`/`init`/`configure` stubs. The real payload is a persistence + phone-home mechanism: `setup.py` overrides the install command (`_Install.run`) to explicitly `shutil.copy2` a `telemetry.pth` file into `self.install_lib` or `site.getsitepackages()[0]`, guaranteeing placement into site-packages. The `.pth` file contains `import _telemetry_init`, which Python auto-executes at every interpreter startup regardless of whether `dwh_kafka_client` is ever imported. `_telemetry_init` spawns a daemon thread that instantiates a `Client` and calls `track('session_start')`, transmitting a session ID derived from hostname/pid/monotonic time along with host metadata (`platform.node()`, OS, `os.cpu_count()`, Python version) to a runtime-discovered destination. The destination is not present in the source: `_telemetry_transport.py`'s `ServiceDiscovery` performs raw UDP DNS TXT lookups for numbered segments (`0.\u003cdomain\u003e`, `N.\u003cdomain\u003e`), concatenates them, and base64-decodes the result to reconstruct the endpoint at runtime, with hardcoded fallback to public resolvers 8.8.8.8 and 1.1.1.1 to bypass corporate DNS filtering. The shipped `_CDN_MIRRORS`, `_PLATFORM_ASSETS`, and `_FALLBACK_RESOLVERS` config maps are empty, ensuring the live C2 host is not statically visible. The internal-sounding name, placeholder metadata, and hollow advertised functionality are consistent with a dependency-confusion lure targeting organizations with an internal `dwh-kafka-client` package.\n\n## Source: kam193 (e449e20bd6e20337c410ab313a6781116f481400435e9cc35316c7cb6fcae8fc)\nPackage presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from one of c.*.dl.well1[.]site domains, depending on the system. This record returns a number, which is then used to iterate over domains in the form \u003c0...n\u003e.*.dl.well1[.]site and reconstruct the encoded executable from their TXT records. The downloaded binary is then executed and removed afterward. Using a PTH file ensures persistence and runs on every Python start. In this campaign, versions 0.0.1 hold disarmed code (without the necessary configuration), which is completed in further updates.\n\nThis is a continuation of the 2026-07-haproxy-config-client campaign.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-07-andreiiiiiii_i\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - Downloads and executes a remote executable.\n\n\n - covering-tracks\n\n\n - persistence\n\n\n - abuses-pth\n\n\n - data-stored-in-dns\n","modified":"2026-08-04T23:05:48.392088389Z","published":"2026-07-17T22:48:25Z","database_specific":{"iocs":{"domains":["package-proxy.cf8oobworker.workers.dev","package-proxy.cf5oobworker.workers.dev","package-proxy.cf25-6eb.workers.dev","package-proxy.cf17-ddb.workers.dev","win.dl.well1.site","tina.dl.well1.site","tin.dl.well1.site","ldr.dl.well1.site"]},"malicious-packages-origins":[{"import_time":"2026-07-20T16:06:06.876589789Z","modified_time":"2026-07-17T22:48:25.193724Z","sha256":"8d5da172b14d4c95e6fd513f62722df1c9005079d8828c35ae63e8e9c49ae6ee","source":"kam193","versions":["0.0.1"],"id":"pypi/2026-07-andreiiiiiii_i/dwh-kafka-client"},{"id":"pypi/2026-07-andreiiiiiii_i/dwh-kafka-client","import_time":"2026-07-20T17:01:49.03358502Z","modified_time":"2026-07-17T22:48:25.193724Z","sha256":"e449e20bd6e20337c410ab313a6781116f481400435e9cc35316c7cb6fcae8fc","source":"kam193","versions":["0.0.1"]},{"modified_time":"2026-08-04T21:41:53Z","sha256":"64f8759150fd0f4909a75613b1311c70c44b514bee2142ed4c67e0ef580afdbe","source":"amazon-inspector","versions":["0.0.1"],"id":"IN-MAL-2026-011164","import_time":"2026-08-04T22:30:02.653135063Z"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/dwh-kafka-client"},{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/06f1c2f0c66cf13ab6702414e8dce7c4115939f3e9cf95e9a8baade58961c016/detection"},{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/230f81f18608800912def92e18999874e004cd9fb4a554f759f77e4dd2030081/detection"},{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/c98444d6aebfd87f2f4412e1d7aafe8fe3fe080139ca1111049ea83fe828cd1d/detection"},{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/1360bb7437f5e7790747bc4e31eedcd19f88f23b20362a42368f4179b8b9e27d/detection"},{"type":"EVIDENCE","url":"https://tria.ge/260720-teqmlshs6y/behavioral1"},{"type":"PACKAGE","url":"https://pypi.org/project/dwh-kafka-client/0.0.1/"}],"affected":[{"package":{"name":"dwh-kafka-client","ecosystem":"PyPI","purl":"pkg:pypi/dwh-kafka-client"},"versions":["0.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dwh-kafka-client/MAL-2026-10915.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"3b2e157d9383b96d3591c354bd80acb2ac525529f18fb1522fe49f22520ea650","tlsh":"04b33cb6ed1bac228177c91e9c86e047f72a4753222c614779bc826c2f74715c2e4eed","path":"_telemetry_transport.py"},{"sha256":"2948aa8597b3432570c12bba17a4c0a7721b98033f3fd9e03c8a002b06dcb9e1","tlsh":"8021877b4ca9283065f5c6249963c8caf9651317b920d48b7afc43082f782d1c74f157","path":"setup.py"}],"package_integrity":[{"filename":"dwh_kafka_client-0.0.1.tar.gz","hashes":{"sha256":"41783d8ea6e8b80c1dedb32138f61408916318acf05eea664db3036beb5f76ab","blake2b_256":"651a80f75cfdc5f2c92fc1ec5da3cf12dacda0690a26442fc6042a22d9620a5a","md5":"fb4abc1701751c33ad9b8181dfee91ab"}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"}]}