{"id":"MAL-2026-11094","summary":"Malicious code in cfgzen (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a904eba641878bae63f76595a468b0faaa66fd27104ac557249e457f005c3fb1)\nThe package installs a site-wide `cfgzen.pth` containing `import dotcfg`, which Python's site machinery executes automatically at every interpreter startup — turning every `python` invocation on the host into a trigger for the payload. On import, `dotcfg/__init__.py` spawns a detached background Python subprocess (env-gated with `_CFGZ_BG=1` and `CREATE_NO_WINDOW` on Windows) that re-imports the package and calls `_native.platform_check()` in the shipped Windows PyO3 extension `dotcfg/_native.pyd`. The native module contains: a hardcoded anonymous file-drop endpoint at `files.catbox.moe/7t4wyu.*`; WinHTTP and raw ws2_32 socket primitives with a spoofed Mozilla Windows User-Agent; enumeration of host identifiers (`COMPUTERNAME`, `HOSTNAME`, `USERNAME`, `USER`, `LOCALAPPDATA`, `TEMP`) staged into a file named `envcorecache.dat`; a CI/sandbox-evasion fingerprint enumerating 14+ build-environment variables (`GITHUB_ACTIONS`, `GITLAB_CI`, `JENKINS_HOME`, `TRAVIS`, `CIRCLECI`, `CODEBUILD_BUILD_ID`, `TF_BUILD`, `BUILDKITE`, `DRONE`, `APPVEYOR`, `CI`, `CONTINUOUS_INTEGRATION`, `TEAMCITY_VERSION`, `HEROKU_TEST_RUN_ID`); and Microsoft-mimicry staging paths (`Microsoft\\EdgeUpdate\\EdgeUpdateService.exe`, `Microsoft\\WindowsApps\\RuntimeBroker_v2.exe`, `Microsoft\\Edge\\Temp\\msedge_installer.exe`, `Microsoft\\MediaSync\\MediaSyncAgent.exe`, `Microsoft\\Provisioning\\ProvisioningHost.exe`). The combination —.pth-based persistence, hidden detached subprocess, host fingerprinting, dual HTTP/socket exfil transports to an anonymous file host, CI-evasion, and Edge/Update-mimicry file names — is a Windows stealer/dropper, not a `.env` parser.\n\n## Source: kam193 (588fed6ec45af5cfb8925b1f7d93b07b73d47b919a50305438153dfbb7f953e1)\nThe malicious code sits in a native module, which is called in a few places, including the code run via PTH embedded since version 1.0.6. The native module downloads an encrypted blob and decrypt it to an executable being an infostealer.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-07-cfgzen\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - exfiltration-env-variables\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - The package contains code to detect if it is running in a sandbox environment.\n\n\n - exfiltration-crypto\n\n\n - native-extension\n\n\n - persistence\n\n\n - abuses-pth\n","modified":"2026-08-05T07:21:40.901815723Z","published":"2026-07-27T22:02:50Z","database_specific":{"malicious-packages-origins":[{"sha256":"588fed6ec45af5cfb8925b1f7d93b07b73d47b919a50305438153dfbb7f953e1","source":"kam193","versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6"],"id":"pypi/2026-07-cfgzen/cfgzen","import_time":"2026-07-27T22:29:49.857909145Z","modified_time":"2026-07-27T22:02:50.352603Z"},{"source":"amazon-inspector","versions":["1.0.6"],"id":"IN-MAL-2026-010991","import_time":"2026-08-04T21:33:12.661202663Z","modified_time":"2026-08-04T21:16:28Z","sha256":"a904eba641878bae63f76595a468b0faaa66fd27104ac557249e457f005c3fb1"},{"id":"IN-MAL-2026-010993","import_time":"2026-08-04T21:33:12.745716964Z","modified_time":"2026-08-04T21:16:50Z","sha256":"ee99f24dad93039ad81daf9e4308c69d3043f4200dfbd58801196df609bbb453","source":"amazon-inspector","versions":["1.0.5"]},{"modified_time":"2026-08-04T21:46:25Z","sha256":"76c1557e956aa676cca98c8127cd35b7080eede7040a99629cd15c9aaac8c9b2","source":"amazon-inspector","versions":["1.0.2"],"id":"IN-MAL-2026-011197","import_time":"2026-08-04T22:30:04.527379386Z"},{"versions":["1.0.4"],"id":"IN-MAL-2026-011199","import_time":"2026-08-04T22:30:04.591298403Z","modified_time":"2026-08-04T21:46:41Z","sha256":"8d3ff8e28be7ffda4b553a6af9b9421e2a1c2100586b77011207f2e70e80960f","source":"amazon-inspector"},{"id":"IN-MAL-2026-011198","import_time":"2026-08-04T22:30:04.564890741Z","modified_time":"2026-08-04T21:46:33Z","sha256":"548747a52caa2acd71163a574065fb3b71234c1bf8c2421fc030908e123682b8","source":"amazon-inspector","versions":["1.0.3"]},{"sha256":"6f5ef038948101b1c7499e4eeb1e1256a0d1f3f064f64f6b21c9641e1fa3bb01","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-013379","import_time":"2026-08-05T07:06:44.395311772Z","modified_time":"2026-08-05T06:14:48Z"},{"modified_time":"2026-08-05T06:15:06Z","sha256":"db13e6e8d60971f8db23572c75dcf0814cf5638acaa58a3b1fb914525ba24f69","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-013381","import_time":"2026-08-05T07:06:44.554939386Z"}],"iocs":{"urls":["https://files.catbox.moe/7t4wyu.bin","http://89.124.86.198/ping","http://89.124.86.198/submit"]}},"references":[{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/051dc1df4ea14c71a25fea528090dd8cfd2c4e02030e6d2f91f6f2f9bad90ec3/detection"},{"type":"EVIDENCE","url":"https://tria.ge/260727-1xjeksde39"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/cfgzen"},{"type":"PACKAGE","url":"https://pypi.org/project/cfgzen/1.0.6/"},{"type":"PACKAGE","url":"https://pypi.org/project/cfgzen/1.0.5/"},{"type":"PACKAGE","url":"https://pypi.org/project/cfgzen/1.0.2/"},{"type":"PACKAGE","url":"https://pypi.org/project/cfgzen/1.0.4/"},{"type":"PACKAGE","url":"https://pypi.org/project/cfgzen/1.0.3/"},{"type":"PACKAGE","url":"https://pypi.org/project/cfgzen/1.0.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/cfgzen/1.0.0/"}],"affected":[{"package":{"name":"cfgzen","ecosystem":"PyPI","purl":"pkg:pypi/cfgzen"},"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"dotcfg/__init__.py","sha256":"2029aa31965661bc87d855aece6f15180557a177850a0446fd43d9e55c5b3859","tlsh":"0b514593ca8694124ab656fb31eea062f7b74307873250da78fc532c2fb611516b907d"},{"path":"dotcfg/_native.pyd","sha256":"180b9f3da8fd1ff9a0cd604ff7721a45c268bcaf2aa419f984f614a03157a2eb","tlsh":"91348c43b5459dfed64b40b0106f976ed635a0000726c9ebd7b44cab8e6bbe20c3d69e"},{"sha256":"e130ff5a39cfea012fa55dda2433a7864e0994d4c7e52dd2c548abe92bd50d67","path":"cfgzen.pth"}],"package_integrity":[{"filename":"cfgzen-1.0.6-cp38-abi3-win32.whl","hashes":{"blake2b_256":"00b7973880136922b9e2e182446607e002f29a91f45051934138b5b22e5ccf4e","md5":"70fd2677a6647d69daeee8393adab3d9","sha256":"62e56f9bd73ee991048566666be674c11135c75b301babeddba6e3f4778c8516"}},{"filename":"cfgzen-1.0.6-cp38-abi3-win_amd64.whl","hashes":{"md5":"91f968b50b9763a84063d798d4540ad8","sha256":"bbae132a24908c047aa196f7f0970ae3ff12e966dea477ddb99d6bd973299045","blake2b_256":"dcdc78f7780ad6903335d580e762debcf641d8eb9c84da9ba32fe4fd0f48ed8e"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/cfgzen/MAL-2026-11094.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}