{"id":"MAL-2026-16044","summary":"Malicious code in tsshare (PyPI)","details":"The package 'tsshaere' was identified as containing malicious obfuscated code in client.py\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (27b53b00771492d758231bd358fe62b1c212a76c2628633e9b3e2c308285779f)\nPackage presents itself as a drop-in replacement for the Tushare pro_api SDK. Its TsshareClient.query method, together with a __getattr__ proxy that captures every attribute access, POSTs the caller-supplied auth_code (the user's tushare.pro credential in the Tushare ecosystem) together with query parameters to a hardcoded default endpoint constructed as base_url + /api/v1/proxy. The default base_url is stored as a base64 byte literal (_E = b\"aHR0cHM6Ly9mc3p6dzU2LmNvbQ==\") and decoded at call time by _default_base_url, resolving to https://fszzw56.com, a host unrelated to Tushare. On first call the client also collects a stable hardware fingerprint — Windows CPU ProcessorId and disk SerialNumber via PowerShell/CIM, macOS Hardware UUID via system_profiler, or Linux /etc/machine-id — SHA-256-hashes it, caches it in ~/.tsshare/device_id.json, and attaches it as meta.device_id on every request. The combination of Tushare-lookalike naming, an obfuscated non-Tushare destination, forwarding of the caller's third-party credential, and stable hardware identifiers routes both the user's Tushare token and machine identity to an author-controlled host the caller never opted into.\n","modified":"2026-09-09T01:45:05.246081569Z","published":"2026-09-04T00:00:00Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019735","import_time":"2026-09-09T01:28:58.636872863Z","modified_time":"2026-09-09T01:20:42Z","sha256":"27b53b00771492d758231bd358fe62b1c212a76c2628633e9b3e2c308285779f","source":"amazon-inspector","versions":["1.0.19"]}]},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/tsshare/1.0.19/"}],"affected":[{"package":{"name":"tsshare","ecosystem":"PyPI","purl":"pkg:pypi/tsshare"},"versions":["1.0.19"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"tsshare/client.py","sha256":"9323e40c5a183d269df723f5f0a018a3cc7c45c9267f514871dd4c583774e204","tlsh":"c24276116a211c27e793c26c9ceae501a7677c03be0829707c8c675c2f9a531f1f9ead"}],"package_integrity":[{"filename":"tsshare-1.0.19-py3-none-any.whl","hashes":{"blake2b_256":"64b2ec98463bfb0e98e01e770a22122991df9c7cde7d3dd9f5758740811cc903","md5":"fefa102513e190d47cd6e628e1290b74","sha256":"8dd15f3fffd046ba286289a6b873587aa6dd6511a5833941e3c2595f57d3d362"}},{"filename":"tsshare-1.0.19.tar.gz","hashes":{"blake2b_256":"16e50a17ab5bb8d136648007ab470bea0ea3ef91e7fe64fd1503bdda5cb1b54b","md5":"9fa90663045b13aedc659fa4225c9e8b","sha256":"4971759a098b6028da02b53261f8005ce4159f4695418374e20be0c9e8672333"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/tsshare/MAL-2026-16044.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Cyberstorm.mu team","contact":["https://github.com/cyberstormdotmu"],"type":"FINDER"}]}