{"id":"MAL-2026-18406","summary":"Malicious code in stdid-nyxprobe (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2ccf3f03f309715ca11fb3863aa89a57d4c0550606cb17839bfff9b5dfd34687)\nThe package installs stdid_nyxprobe.pth into site-packages, whose sole content is `import stdid_nyxprobe._beacon`. Python's site.py mechanism evaluates this on every interpreter start after `pip install`, with no user-initiated import required. The imported module stdid_nyxprobe/_beacon.py collects host identifiers — hostname (socket.gethostname), LAN IP (via `hostname -I`), username (getpass.getuser), current working directory, and Python version — and POSTs them to https://api.telegram.org/bot\u003ctoken\u003e/sendMessage using a hardcoded bot token (8984095380:AAHN...) and two hardcoded chat IDs (1841775463, -5380294525). A sentinel file at ~/.cache/.stdid_beacon_fired is written to suppress repeat beacons. The package has no documented legitimate functionality that would justify this behavior; the.pth auto-exec primitive is being used purely as a persistence/auto-trigger vector for the exfiltration payload.\n\n## Source: kam193 (0178d6c7a642f90327546548a88f64bd17da5aa97e519249f515c0e6232c73f1)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","modified":"2026-10-30T12:45:13.385042287Z","published":"2026-10-30T10:03:06Z","database_specific":{"malicious-packages-origins":[{"versions":["0.0.1","0.0.2"],"id":"pypi/GENERIC-standard-pypi-install-pentest/stdid-nyxprobe","import_time":"2026-10-30T10:13:02.408406079Z","modified_time":"2026-10-30T10:03:06.781216Z","sha256":"0178d6c7a642f90327546548a88f64bd17da5aa97e519249f515c0e6232c73f1","source":"kam193"},{"id":"IN-MAL-2026-022422","import_time":"2026-10-30T12:42:29.579464666Z","modified_time":"2026-10-30T12:28:26Z","sha256":"2ccf3f03f309715ca11fb3863aa89a57d4c0550606cb17839bfff9b5dfd34687","source":"amazon-inspector","versions":["0.0.2"]},{"versions":["0.0.1"],"id":"IN-MAL-2026-022445","import_time":"2026-10-30T12:42:31.35916659Z","modified_time":"2026-10-30T12:31:13Z","sha256":"bc11a41bf569b62e65aa2a2913e3659c51a97ea1798c09e4d3ecef58add76e52","source":"amazon-inspector"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/stdid-nyxprobe"},{"type":"PACKAGE","url":"https://pypi.org/project/stdid-nyxprobe/0.0.2/"},{"type":"PACKAGE","url":"https://pypi.org/project/stdid-nyxprobe/0.0.1/"}],"affected":[{"package":{"name":"stdid-nyxprobe","ecosystem":"PyPI","purl":"pkg:pypi/stdid-nyxprobe"},"versions":["0.0.1","0.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"stdid_nyxprobe-0.0.2-py3-none-any.whl","hashes":{"md5":"5e4fb8988b0d57ed75b257a9aac006db","sha256":"8e089256555a08787fd573dc2f97b388630df7f2391e4ecabeeb1e22dfa6ac8d","blake2b_256":"26a61ce72eb0845c847f218584cf740059387cb7ce69493e281e5103f640310b"}}],"evidence_files":[{"sha256":"7b7e6f6c8a850c6aa43bad42a14e96233fe553f8a508a8eb47da63e4cc827f73","tlsh":"f73114d1f82258f6e68bc194882085b436636907a513ec35fdee53106fcb0b1c172bba","path":"stdid_nyxprobe/_beacon.py"},{"sha256":"b7c973a0d907af04947d86520e358e58455c5d9fc1ee3a19370732ef69f58250","path":"stdid_nyxprobe.pth"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/stdid-nyxprobe/MAL-2026-18406.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}