{"id":"MAL-2026-11031","summary":"Malicious code in govapkg (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf)\ngovapkg presents itself as a client for pkg.go.dev but on any use of its public API (get/package/module) invokes an internal helper govpkg._internal.normalizeHelper that base64-decodes a hidden URL to https://teeny-cent.surge.sh/client, downloads the response to ~/.local/bin/systemdserv, sets the executable bit, and spawns it detached via subprocess.Popen with start_new_session=True. The helper then writes ~/.config/autostart/systemdserv.desktop with Exec pointing at the dropped binary and Name 'Systemd Service Manager', establishing user-level persistence that re-launches the attacker binary on every desktop login. The download destination is an anonymous static-hosting domain unrelated to the package's advertised Go documentation purpose, the URL is base64-obfuscated to evade string scans, and no hash or signature is verified on the fetched bytes.\n\n## Source: kam193 (c23fe2f960316aca782b4319dac6f960d4397ec40428d34e28b1769cd0bff4b4)\nWhen using the provided functionality, the package silently downloads a malicious executable and ensures its persistence disguised as a system service. The binary connects with telegra[.]ph. It appears that the contacted URL is built from the template https://api.telegra.ph/getPage/whisperer-MM-DD and contains an advertisement for a Telegram channel.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-07-govpkg\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - action-hidden-in-lib-usage\n\n\n - persistence\n","modified":"2026-07-28T14:37:29.164665393Z","published":"2026-07-23T20:06:38Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-07-23T20:06:38.840554Z","versions":["0.1.0"],"source":"kam193","sha256":"aa79a3120abb07b8e73d784c41300631c6a9b9654a653a916bddb4bb86bbc088","import_time":"2026-07-23T20:57:19.188096397Z","id":"pypi/2026-07-govpkg/govapkg"},{"import_time":"2026-07-23T21:29:54.864262779Z","id":"pypi/2026-07-govpkg/govapkg","modified_time":"2026-07-23T20:06:38.840554Z","versions":["0.1.0"],"source":"kam193","sha256":"c23fe2f960316aca782b4319dac6f960d4397ec40428d34e28b1769cd0bff4b4"},{"modified_time":"2026-07-28T13:43:42Z","versions":["0.1.0"],"source":"amazon-inspector","sha256":"6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf","import_time":"2026-07-28T14:20:01.997158306Z","id":"IN-MAL-2026-010971"}],"iocs":{"urls":["https://temp.sh/NBZzm/client","https://teeny-cent.surge.sh/client"],"domains":["teeny-cent.surge.sh"]}},"references":[{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/7bd6824cbcb603a4cc79728985557a74c876db2d1e8a71e2120d79e3e507525a/detection"},{"type":"EVIDENCE","url":"https://app.any.run/tasks/0fc6b9f4-8052-435b-9c0a-3d48dfe79018"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/govapkg"},{"type":"PACKAGE","url":"https://pypi.org/project/govapkg/0.1.0/"}],"affected":[{"package":{"name":"govapkg","ecosystem":"PyPI","purl":"pkg:pypi/govapkg"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/govapkg/MAL-2026-11031.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"govapkg-0.1.0-py3-none-any.whl","hashes":{"sha256":"cdec7b16aa6e85a09feec3e97573c0255d0219ea9c3072a41a423df1b8a18ee5","blake2b_256":"7b51a36d1082f52d9c60bd7ca1c9a7bdd93167041f66eb51f31e29ea52a06f93","md5":"e19335475dc2327005674ecd6b9297f8"}}],"evidence_files":[{"sha256":"e12c648689cc17ee89be1c21037bd8fe3a0af8be2f584069fc2a8b3a02dd359f","tlsh":"3221f157c686397082c68270145265294aaef81f9b878830bbbd9bd08f85d2e50a9a7d","path":"govpkg/_internal.py"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}