{"id":"MAL-2026-17629","summary":"Malicious code in zencleaner (PyPI)","details":"When a license key is activated or deactivated in the local UI, zencleaner/webhook_logger.py posts the key, the PC name, the Windows user name and the client IP to a hardcoded Discord webhook, although the README says nothing is sent to the internet. 1.0.3 and 1.0.3.1 also look up the public IP through ipify.org and ifconfig.me. Separately, cleaner_system.py clears the Windows event logs, Security included, with wevtutil; a comment in that function reads \"so forensic scanners report 0 entries\". Nothing runs at install time. I read all three versions and did not run them.","modified":"2026-10-05T23:15:05.012849028Z","published":"2026-10-03T22:47:45Z","database_specific":{"iocs":{"urls":["https://discord.com/api/webhooks/1555423493796012102"]}},"affected":[{"package":{"name":"zencleaner","ecosystem":"PyPI","purl":"pkg:pypi/zencleaner"},"versions":["1.0.0","1.0.3","1.0.3.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/zencleaner/MAL-2026-17629.json"}}],"schema_version":"1.9.0","credits":[{"name":"smiling-hyena","contact":["smilinghyena4@gmail.com"],"type":"FINDER"}]}