{"id":"MAL-2026-18299","summary":"Malicious code in claudeopuseni (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (715421a3b919f086db6ad4a57d6c8d6d333b019e3a63e607be95cf3fcb7aef5d)\nOn import, claudeopuseni/__init__.py invokes _boot.check(), which issues an HTTPS GET to https://thisisafalsepositive.st/cdn/v2/claudeopuseni/manifest.json, reads field 'r' as an encrypted blob (falling back to the base64-encoded _payload.PAYLOAD bundled in _payload.py when the host is unreachable), decrypts it with a ChaCha20+HMAC routine in security.unsign keyed from sha256(b'claudeopuseni.2026.channel.v1'), and passes the plaintext to builtins.exec via an attribute name assembled from chr(101,120,101,99) to hide the sink from static scanners. _boot gates detonation on the presence of a real user profile (USERPROFILE/HOME containing Documents or Downloads) and on absence of DAS_STAGED=1 or claudeopuseni_TELEMETRY=0, and caches a timestamp to suppress re-execution within 6 hours — a sandbox/CI evasion wrapper. The embedded fallback blob guarantees execution of attacker-controlled code even when the remote host is unavailable. The resulting code runs with the importing developer's privileges on any machine that imports the package in a normal user environment. The package name resembles the Anthropic Claude product family, consistent with a typosquat lure.\n\n## Source: kam193 (355cfc006ca4cb062c248bf2108be828c6164ae20d12ee5c7794ab68ee351843)\nDuring installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-donutautosellsrc\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - The package contains code to detect if it is running in a sandbox environment.\n\n\n - malware\n\n\n - native-extension\n\n\n - steganography\n\n\n - c2-in-blockchain\n","modified":"2026-10-26T06:45:15.072389104Z","published":"2026-10-25T23:43:00Z","database_specific":{"iocs":{"urls":["https://thisisafalsepositive.st/cdn/v2/9f4e7a2c1b8d.png","https://thisisafalsepositive.st/cdn/v2/promotion/manifest.json","https://thisisafalsepositive.st/shard/submitData","https://thisisafalsepositive.st/shard/submitLogs","https://thisisafalsepositive.st/shard/submitFile"],"domains":["thisisafalsepositive.st","sltnnt.ru"]},"malicious-packages-origins":[{"sha256":"355cfc006ca4cb062c248bf2108be828c6164ae20d12ee5c7794ab68ee351843","source":"kam193","versions":["0.1.0","0.1.1"],"id":"pypi/2026-09-donutautosellsrc/claudeopuseni","import_time":"2026-10-26T00:47:12.490796728Z","modified_time":"2026-10-25T23:43:00.903471Z"},{"id":"IN-MAL-2026-021760","import_time":"2026-10-26T06:39:40.866293174Z","modified_time":"2026-10-26T06:29:33Z","sha256":"4304d9b2064d8e9c445c86165f8155cdd504f9cca24a8ad41343b702a01ad6e7","source":"amazon-inspector","versions":["0.1.1"]},{"id":"IN-MAL-2026-021756","import_time":"2026-10-26T06:39:40.613006043Z","modified_time":"2026-10-26T06:29:05Z","sha256":"715421a3b919f086db6ad4a57d6c8d6d333b019e3a63e607be95cf3fcb7aef5d","source":"amazon-inspector","versions":["0.1.0"]}]},"references":[{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e/detection"},{"type":"WEB","url":"https://polygonscan.com/address/0x9c0a507300fd902787bb193d80fca5ce6e1bff9a"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/claudeopuseni"},{"type":"PACKAGE","url":"https://pypi.org/project/claudeopuseni/0.1.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/claudeopuseni/0.1.0/"}],"affected":[{"package":{"name":"claudeopuseni","ecosystem":"PyPI","purl":"pkg:pypi/claudeopuseni"},"versions":["0.1.0","0.1.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"claudeopuseni/compat.py","sha256":"e2ca1ce9ea6bce9a72851797ea2197d4e2260dfe8dca7c253c8deafa8dd4f7d6","tlsh":"80110c568d4a6db24231d1188961c8adc26e0a07b9751042beac07bc2f30a61d6eb8ce"},{"tlsh":"20a002074480077378d81147fb3264070bb50b1456c0a0847a3f1d3947c8c2d8804dde","path":"claudeopuseni.pth","sha256":"6bf2f158461654eae12ace5291b25288ffe5db726601babc55a12213758f7374"},{"path":"CHANGELOG.md","sha256":"5bd071bf9db5087c9cc307adc48115890615b3c946483cc00a6b1282178e4843","tlsh":"94f0eb105722c32e1af984a3da69c6678320706d666f60845bde32ac8b4e855e83d4ce"}],"package_integrity":[{"filename":"claudeopuseni-0.1.1-py3-none-any.whl","hashes":{"blake2b_256":"5a1e292fb1dbcff7e08dcf04fbef0fe921cd33cbb48daae5da3d7c9ad5825d2d","md5":"f39b82670005c2ca1a2c589eb9a2e239","sha256":"cdb9dc31ce742187d9a8322d85cf7c46527394ba41826220faa7d6f9036e0d8d"}},{"hashes":{"sha256":"9a1dddbdc08a251e6f47ffc2aca45fa4d40b959cab075d6bc0187dedf2cd31ba","blake2b_256":"cddca2e59c79841f2a6f5b9c19e7679c5fcf793cf5bf3f476db286c3ff730a27","md5":"a669ef36d26a1724030c50cc1d37d3aa"},"filename":"claudeopuseni-0.1.1.tar.gz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/claudeopuseni/MAL-2026-18299.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}