{"id":"MAL-2026-5272","summary":"Malicious code in goodoltoulas (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (98a84d10e07878c98ffa21b3920940b10ffac4d3cdd66250c046391ea502aaff)\nOn `pip install goodoltoulas`, setup.py unconditionally invokes setup_helper(), which downloads an opaque PE binary from an anonymous file-hosting service (storage.filebin.net) into C:\\MALWARE_DELETE\\main.exe and launches it via subprocess.Popen with CREATE_NEW_CONSOLE. There is no hash check, signature verification, or version pinning, and the host is unrelated to any package publisher. The library surface is a thin decoy: __init__.py forwards all attribute access to the `requests` module and the README advertises 'A simple request cloner for Python', providing cover for the install-time dropper. The drop path uses a self-incriminating directory name (C:\\MALWARE_DELETE) and the response carries application/vnd.microsoft.portable-executable, confirming hostile intent. Any Windows installer running `pip install` will execute attacker-controlled code immediately.\n\n## Source: kam193 (d1279e2d267bf2af95bf5c3a98cc71ac362ed2af7aa35f6bbfe1f05bb839cb18)\nDuring installation, package attempts to download and run an executable imitating malicious activity.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: 2026-06-goodoldtoulas\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - Downloads and executes a remote executable.\n","modified":"2026-06-12T20:02:00.173146103Z","published":"2026-06-05T19:06:34Z","database_specific":{"iocs":{"urls":["https://cold-eu-par-1.gofile.io/download/web/deb39e07-da2d-4081-a86b-6380e555788c/main.exe"]},"malicious-packages-origins":[{"source":"kam193","sha256":"d1279e2d267bf2af95bf5c3a98cc71ac362ed2af7aa35f6bbfe1f05bb839cb18","versions":["0.1.0"],"id":"pypi/2026-06-goodoldtoulas/goodoltoulas","modified_time":"2026-06-05T19:06:35.125485Z","import_time":"2026-06-05T20:11:44.760252838Z"},{"source":"amazon-inspector","sha256":"98a84d10e07878c98ffa21b3920940b10ffac4d3cdd66250c046391ea502aaff","versions":["0.1.0"],"id":"IN-MAL-2026-006185","modified_time":"2026-06-12T19:10:50Z","import_time":"2026-06-12T19:44:17.608821008Z"},{"source":"amazon-inspector","sha256":"ee2ef27464f7f6b4aa1b5615a42ebd130e31cf169a4f3396656108d63a326b1b","versions":["0.1.0"],"id":"IN-MAL-2026-006186","modified_time":"2026-06-12T19:10:50Z","import_time":"2026-06-12T19:44:17.697615511Z"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/goodoltoulas"},{"type":"PACKAGE","url":"https://pypi.org/project/goodoltoulas/0.1.0/"}],"affected":[{"package":{"name":"goodoltoulas","ecosystem":"PyPI","purl":"pkg:pypi/goodoltoulas"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/goodoltoulas/MAL-2026-5272.json","cwes":[{"name":"Embedded Malicious Code","description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"hashes":{"sha256":"65008e17bddbd159ac4eda117d57ed9c43e043b0b7ddf02b8689da5f317b28f3","md5":"2429c6426cf2a0d433a75a4a43cf3a84","blake2b_256":"47884f0279b1d41f0a75db7f9ba4d7d8ed6594a8dc99a89622f5e16a1514af14"},"filename":"goodoltoulas-0.1.0-py3-none-any.whl"},{"hashes":{"sha256":"61b77b654cede432d7bb4d1bdf7b8ecac07e9244c4a4090aa478704e74514a99","md5":"5785a39f923578e1bc28c6505017f41d","blake2b_256":"586b62d969803ee06cb19040afb474334050b44312c94559092a77788d402c81"},"filename":"goodoltoulas-0.1.0.tar.gz"}],"domains":["storage.filebin.net"],"evidence_files":[{"sha256":"5d4bf30c6967d269a6ab169902074c7b8f409800162f543c45665f91137f45a0","path":"setup.py","tlsh":"7431b5aece0010909382bd182e8389ad257bb123bb63e4e53d9c41503fc9295d3d355e"},{"sha256":"9057287e8115fadd6886e030f535cf50b2cb4fe19cdac9b9b3619424fb67eaf2","path":"goodoltoulas/__init__.py","tlsh":"c0e0c0a72c217137ff0989684f1167565da63d33140a6070349ce0733f415108d300ca"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}