{"id":"MAL-2026-18762","summary":"Malicious code in rainbowcolors (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd)\nThe package advertises itself as an ANSI-color helper but on Windows the first call to any Color method (print/paint/__call__) downloads an opaque executable (solace.exe) from an anonymous gofile.io file-share URL (https://store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe) into %TEMP%\\SolaceRuntime and launches it with DETACHED_PROCESS. Before and after the download the module shells out to PowerShell (-NoProfile -ExecutionPolicy Bypass, with CREATE_NO_WINDOW) to call Add-MpPreference -ExclusionPath and -ExclusionProcess for the drop folder and executable, pre-registering Microsoft Defender exclusions to evade antivirus. The fetched binary bears no relation to the advertised color-printing functionality and is retrieved from a mutable anonymous host with no integrity check.\n","modified":"2026-11-08T10:15:04.009222371Z","published":"2026-11-08T09:39:04Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-11-08T10:11:08.651141212Z","modified_time":"2026-11-08T09:39:04Z","sha256":"c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd","source":"amazon-inspector","versions":["0.1.0"],"id":"IN-MAL-2026-022562"}]},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/rainbowcolors/0.1.0/"}],"affected":[{"package":{"name":"rainbowcolors","ecosystem":"PyPI","purl":"pkg:pypi/rainbowcolors"},"versions":["0.1.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"blake2b_256":"ca21313055b71e4c36722bcfd947744dd12c7f4db9aa823a780be0adcb4546ad","md5":"3db103695c63c314c5816d5b50607824","sha256":"53af92c4ffdaeda7d3e08f538869a8e9c04091e9a94d6064f28fb7281f52c143"},"filename":"rainbowcolors-0.1.0-py3-none-any.whl"},{"filename":"rainbowcolors-0.1.0.tar.gz","hashes":{"md5":"1b0c8719fa39215c0f3fc6b9efc222ce","sha256":"3a87e8e876667c894f35da6edaf7aa32874a0590214d69b1192529b7dab730f4","blake2b_256":"949ea6bd44c9d2c1e2a37631fd7f68b186372ee87c654f2b4fed8d54fa677074"}}],"evidence_files":[{"sha256":"ad15e4c2956bc82edde5ab8375b999eb8bf8bb7eeb7a6d8b72d0e30d1a5c096d","tlsh":"6b614001d8096452e343d9a594a288532bafbc036daf2834bdacd3687f4e53cc1f98dd","artifacts":["rainbowcolors-0.1.0.tar.gz","rainbowcolors-0.1.0-py3-none-any.whl"],"path":"src/rainbowcolors/core.py"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/rainbowcolors/MAL-2026-18762.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}