{"id":"MAL-2026-10916","summary":"Malicious code in python-devplatform-client (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8daa66fc6fa92869318e5a544d82fab2d5dff870dc4c6784f28733f84441415a)\nThe package's setup.py copies a telemetry.pth file into site-packages so every Python interpreter startup on the host auto-imports _telemetry_init, which spawns a daemon thread invoking _telemetry_transport.Client.initialize(). That client selects a platform-keyed asset path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) from a list of anonymous Cloudflare Workers mirrors (package-proxy.cf5oobworker.workers.dev, cf8oobworker/cf12oobworker/cf17-ddb/cf25-6eb.workers.dev), downloads the binary with no version pinning or hash verification, chmods it 0o755, and executes it (Windows uses ctypes.windll.kernel32 CreateProcess). A fallback ServiceDiscovery routine opens raw UDP sockets to 8.8.8.8/1.1.1.1 and issues TXT lookups against tin/tina/ldr/win.dl.well1.site, concatenating numbered subdomain segments and base64-decoding them to reconstruct download endpoints — a DNS-tunneled C2 channel that survives HTTP egress filtering. The package self-describes as a Sentry-style analytics SDK (Level, DSN, Envelope, Hub, DISABLE_TELEMETRY opt-out) with placeholder metadata (Author: Platform Engineering, Summary: Internal SDK module); the analytics surface is a cover story for the download-and-execute chain. The.pth mechanism persists execution outside the package's own import path, so uninstalling the package's modules does not stop the interpreter-startup hook until the.pth file itself is removed from site-packages.\n\n## Source: kam193 (2b75d4d8e3c822aa82b716e6752c0901447845d442973ce9bc35c78b9c81c78a)\nPackage presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from one of c.*.dl.well1[.]site domains, depending on the system. This record returns a number, which is then used to iterate over domains in the form \u003c0...n\u003e.*.dl.well1[.]site and reconstruct the encoded executable from their TXT records. The downloaded binary is then executed and removed afterward. Using a PTH file ensures persistence and runs on every Python start. In this campaign, versions 0.0.1 hold disarmed code (without the necessary configuration), which is completed in further updates.\n\nThis is a continuation of the 2026-07-haproxy-config-client campaign.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-07-andreiiiiiii_i\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - Downloads and executes a remote executable.\n\n\n - covering-tracks\n\n\n - persistence\n\n\n - abuses-pth\n\n\n - data-stored-in-dns\n","modified":"2026-08-05T07:21:41.787795569Z","published":"2026-07-18T14:13:52Z","database_specific":{"iocs":{"domains":["package-proxy.cf8oobworker.workers.dev","package-proxy.cf5oobworker.workers.dev","package-proxy.cf25-6eb.workers.dev","package-proxy.cf17-ddb.workers.dev","win.dl.well1.site","tina.dl.well1.site","tin.dl.well1.site","ldr.dl.well1.site"]},"malicious-packages-origins":[{"modified_time":"2026-07-20T14:11:29.731509Z","sha256":"00edd685ee9e9d7b4bab294f11c583434d683b963af5df00fbb1c4eb6df176e0","source":"kam193","versions":["0.0.1","8.5.3","8.5.4"],"id":"pypi/2026-07-andreiiiiiii_i/python-devplatform-client","import_time":"2026-07-20T16:06:06.877551373Z"},{"id":"pypi/2026-07-andreiiiiiii_i/python-devplatform-client","import_time":"2026-07-20T17:01:49.035133256Z","modified_time":"2026-07-20T14:11:29.731509Z","sha256":"2b75d4d8e3c822aa82b716e6752c0901447845d442973ce9bc35c78b9c81c78a","source":"kam193","versions":["0.0.1","8.5.3","8.5.4"]},{"id":"IN-MAL-2026-010997","import_time":"2026-08-04T21:33:12.871719792Z","modified_time":"2026-08-04T21:17:22Z","sha256":"6d5a2ab0ca1218bc9891e144175e097c4971783defbb7dbfc5effe0aacb4a4f0","source":"amazon-inspector","versions":["8.5.3"]},{"import_time":"2026-08-04T21:33:12.827203784Z","modified_time":"2026-08-04T21:17:13Z","sha256":"8daa66fc6fa92869318e5a544d82fab2d5dff870dc4c6784f28733f84441415a","source":"amazon-inspector","versions":["8.5.4"],"id":"IN-MAL-2026-010996"},{"modified_time":"2026-08-05T06:15:52Z","sha256":"f0ce9b74244d2517ccba2c761ce516e374def55d30df80d4ec108b9fbfe7a5c1","source":"amazon-inspector","versions":["0.0.1"],"id":"IN-MAL-2026-013387","import_time":"2026-08-05T07:06:44.935903038Z"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/python-devplatform-client"},{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/06f1c2f0c66cf13ab6702414e8dce7c4115939f3e9cf95e9a8baade58961c016/detection"},{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/230f81f18608800912def92e18999874e004cd9fb4a554f759f77e4dd2030081/detection"},{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/c98444d6aebfd87f2f4412e1d7aafe8fe3fe080139ca1111049ea83fe828cd1d/detection"},{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/1360bb7437f5e7790747bc4e31eedcd19f88f23b20362a42368f4179b8b9e27d/detection"},{"type":"EVIDENCE","url":"https://tria.ge/260720-teqmlshs6y/behavioral1"},{"type":"PACKAGE","url":"https://pypi.org/project/python-devplatform-client/8.5.3/"},{"type":"PACKAGE","url":"https://pypi.org/project/python-devplatform-client/8.5.4/"},{"type":"PACKAGE","url":"https://pypi.org/project/python-devplatform-client/0.0.1/"}],"affected":[{"package":{"name":"python-devplatform-client","ecosystem":"PyPI","purl":"pkg:pypi/python-devplatform-client"},"versions":["0.0.1","8.5.3","8.5.4"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-devplatform-client/MAL-2026-10916.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"_telemetry_init.py","sha256":"ca829c0a64e5aae78bc2e93aeb6897b5b3a4b0b60d2266ef1ffca4aed68ed532","tlsh":"b6d1a627ed151d72c547e3a698a6d1a1e32b59132e907078bddc831c1f8822782ff5bd"},{"sha256":"d93b3cc1b6425b5af5d7d3820010fc1672c6dc25958f7394ebb2827863ad7b2f","tlsh":"7ab351a6e42a6c62c247d82a4c97f143772f6c53160c64787dfc825c2f59729c2f6ee8","path":"_telemetry_transport.py"},{"tlsh":"b311ab241ad2d93576f3060b6982c2b7c1728691298bb04cb8f303dd8a69d98c77e33d","path":"PKG-INFO","sha256":"37370825619f814f8389ef9352ccdd45928f8b282db988265b678842133344f9"}],"package_integrity":[{"filename":"python_devplatform_client-8.5.3.tar.gz","hashes":{"blake2b_256":"5372698bea5a418fbb54ef83d5d8a1c00ceda1d321770012ac65c1d9ce6a31e7","md5":"c3ce1c6ea0946287efb03602c6e0b747","sha256":"cf3c369ebc1c0298a03ed9a00d2a7eb74dbbd2e67dd7efbca6766eb2c8046778"}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"}]}