{"id":"MAL-2026-18759","summary":"Malicious code in chromacli (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (faa55f651aa1c9e23d9cbff405b6ca52086c950c76e05e04b8dd49f74dd19959)\nThe package presents itself as a terminal color library, but its exported API (Color.paint / print / __call__) contains an import-reachable Windows code path that downloads an unsigned executable from the anonymous file-sharing host gofile.io (https://store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe), writes it to %TEMP%\\SolaceRuntime\\solace.exe, and launches it detached via subprocess.Popen with DETACHED_PROCESS. Immediately before the drop, the code invokes PowerShell with -NoProfile -ExecutionPolicy Bypass and CREATE_NO_WINDOW to call Add-MpPreference -ExclusionPath for the SolaceRuntime folder and -ExclusionProcess for solace.exe, suppressing Microsoft Defender detection of the staged binary. The behavior is gated by os.name == 'nt' and has no connection to the package's stated color-printing purpose. The payload is unsigned, unverified, hosted on an anonymous share, and the Defender-exclusion-before-execute pattern is characteristic of Windows malware droppers.\n\n## Source: kam193 (bda96ece61753bb78748a2c20ac00ec7bfec0de9f6c67dded724f1046fd2c17d)\nPackage hides a code downloading and installing an infostealer.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-chromacli\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - malware\n\n\n - infostealer\n\n\n - action-hidden-in-lib-usage\n","modified":"2026-11-08T10:15:04.112167506Z","published":"2026-11-08T09:38:34Z","database_specific":{"iocs":{"urls":["https://cdn.discordapp.com/attachments/1560347732839891076/1562446203021566032/bedwars.exe?ex=6af1172b&is=6aefc5ab&hm=544b5aacd95a3a0cba1db54a7e7adba093e4b68b8e37c9ec7af805e8fc5e960b&","https://store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-022563","import_time":"2026-11-08T10:11:08.746410777Z","modified_time":"2026-11-08T09:39:11Z","sha256":"649fbd930cef7b2a2d18cede8f17c01c9ea284d193d4000208395fecd01a7a38","source":"amazon-inspector","versions":["0.1.2"]},{"modified_time":"2026-11-08T09:38:58Z","sha256":"faa55f651aa1c9e23d9cbff405b6ca52086c950c76e05e04b8dd49f74dd19959","source":"amazon-inspector","versions":["0.1.0"],"id":"IN-MAL-2026-022561","import_time":"2026-11-08T10:11:08.558245127Z"},{"source":"kam193","versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4"],"id":"pypi/2026-11-chromacli/chromacli","import_time":"2026-11-08T10:11:12.714403322Z","modified_time":"2026-11-08T09:52:34.695685Z","sha256":"bda96ece61753bb78748a2c20ac00ec7bfec0de9f6c67dded724f1046fd2c17d"},{"modified_time":"2026-11-08T09:38:49Z","sha256":"72936049f7fbdfd5d353f183971aae09e9d83bb9520b2cf330379314bebded89","source":"amazon-inspector","versions":["0.1.1"],"id":"IN-MAL-2026-022560","import_time":"2026-11-08T10:11:08.475424472Z"},{"sha256":"d3adaa2c55288f2e59f05016afa470141220c8dd727382662844841620bef003","source":"amazon-inspector","versions":["0.1.3"],"id":"IN-MAL-2026-022559","import_time":"2026-11-08T10:11:08.386614907Z","modified_time":"2026-11-08T09:38:42Z"},{"source":"amazon-inspector","versions":["0.1.4"],"id":"IN-MAL-2026-022558","import_time":"2026-11-08T10:11:08.26315913Z","modified_time":"2026-11-08T09:38:34Z","sha256":"f8413360c72813148ac0903f044810f71b7747b1da6990714faa8bec876f3135"}]},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/chromacli/0.1.2/"},{"type":"PACKAGE","url":"https://pypi.org/project/chromacli/0.1.0/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/chromacli"},{"type":"PACKAGE","url":"https://pypi.org/project/chromacli/0.1.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/chromacli/0.1.3/"},{"type":"PACKAGE","url":"https://pypi.org/project/chromacli/0.1.4/"}],"affected":[{"package":{"name":"chromacli","ecosystem":"PyPI","purl":"pkg:pypi/chromacli"},"versions":["0.1.2","0.1.0","0.1.1","0.1.3","0.1.4"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"chromacli-0.1.2-py3-none-any.whl","hashes":{"blake2b_256":"e770192dbd53e0cdbfe103da3b993659deaa7db1479fd7bc78c9374cd10b7bbc","md5":"ef5a7309587979a016c9bf33e28dca5a","sha256":"0619e194f7b3b6c5e1163f84f93c713437d251fc75b6b8d5853d10ddfa84c612"}}],"evidence_files":[{"sha256":"3e8c691c28ea714b2b64f03682e538757c0a2853866dddf02e4e17cb56d397e1","tlsh":"91715202d8495062e383c9b494a289632baebc0359ab18347d9cc3b87f4e139c1f89dd","artifacts":["chromacli-0.1.2-py3-none-any.whl"],"path":"chromacli/core.py"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/chromacli/MAL-2026-18759.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}