{"id":"MAL-2026-4742","summary":"Malicious code in aurapro-ui (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cace553d74971e3660a0a7095662488f531348ba3e756696da5ff0ef9645ab22)\nThe PyPI package aurapro-ui installs its code under the Python import namespace `open_webui/` and registers two console scripts in entry_points.txt — `aurapro-ui` and `open-webui` — both pointing at `open_webui.cli:app`. Installing aurapro-ui on a system that has (or later receives) the legitimate `open-webui` package causes silent module-import and CLI-binary collisions: `import open_webui` and the `open-webui` shell command resolve to whichever package was installed last, with no warning to the operator. Package metadata compounds the deception: `Author-email` is set to `Timothy Jaeryang Baek \u003ctim@openwebui.com\u003e` (the maintainer of the unrelated upstream Open WebUI project), and the README is a search-and-replace rebrand of the upstream README still linking to docs.openwebui.com, openwebui.com, and the upstream Discord, despite aurapro-ui having no documented relationship to that project. The current 3.2.5 payload appears to be a rebrand of the upstream code with no exfiltration or RCE at import time, but the namespace foothold + falsified authorship establish staging for a future malicious update to silently replace the real `open_webui` module and `open-webui` CLI on any machine that installed aurapro-ui.\n","modified":"2026-06-15T00:15:55.935143758Z","published":"2026-05-19T22:01:39Z","withdrawn":"2026-06-13T01:41:13Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-003289","modified_time":"2026-05-19T22:01:39Z","versions":["3.2.5"],"source":"amazon-inspector","sha256":"cace553d74971e3660a0a7095662488f531348ba3e756696da5ff0ef9645ab22","import_time":"2026-05-26T05:50:21.499081011Z"},{"source":"amazon-inspector","sha256":"ccee51c0781c2bba026520047f5f365ba3f12716f464339265c48259a3a3cd15","import_time":"2026-06-12T19:44:19.576288088Z","id":"IN-MAL-2026-006203","modified_time":"2026-06-12T19:11:11Z","versions":["3.4.15"]}]},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/aurapro-ui/3.2.5/"},{"type":"PACKAGE","url":"https://pypi.org/project/aurapro-ui/3.4.15/"}],"affected":[{"package":{"name":"aurapro-ui","ecosystem":"PyPI","purl":"pkg:pypi/aurapro-ui"},"versions":["3.2.5","3.4.15"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"aurapro_ui-3.2.5.dist-info/entry_points.txt","sha256":"8a592c07ddbad4194961baee566281ad1765006b6083b32fb185c42130198179","tlsh":"e1a01208cc47402a3b3b2f185634c8227102082835405c80ea0023d182c08b42640134"},{"path":"aurapro_ui-3.2.5.dist-info/METADATA","sha256":"7f6dd0675120611b6520af3a949f81ffef8f5fca8d0cda367278f46ea879133a","tlsh":"1db2b6ab9fa41766efd281c7f29e169ba62dc06d120d44c6b43dc2dc13c93b583b61b4"}],"package_integrity":[{"hashes":{"sha256":"9a412a119aeb24bd9af474029a50ad3f0d307d8d85b913634634cf2d75f48106","blake2b_256":"ac3ed777426a00698b2ccd1dff56f256f30d5c5a0f949b6105c0bf0a8edf8028","md5":"0a70f05823b66ae8fbe29cc4a79efbf6"},"filename":"aurapro_ui-3.2.5-py3-none-any.whl"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/pypi/aurapro-ui/MAL-2026-4742.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com","inspector-research@amazon.com"],"type":"FINDER"}]}