{"id":"MAL-2026-6290","summary":"Malicious code in toorc (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2cfd36909e089f17439dd3227c6f5ccef2fef2964dc26bbdbaaef0481b54615d)\nOn `pip install` (and even `pip download`), the package's setup.py overrides the `install` and `egg_info` commands to execute a RunCommand() routine that serializes every entry in `os.environ` into a key=value query string and captures the output of `ps -elf`. The combined payload is then POSTed via curl over plaintext HTTP to `http://gjampdwmdjmppwedtkpbbdkq05f6iiz6r.oast.fun`, a unique subdomain on the public interactsh out-of-band testing service. Any CI/build secrets present in the environment at install time (AWS_*, GITHUB_TOKEN, NPM_TOKEN, CI provider tokens, etc.) leak to the attacker-controlled OAST listener, along with a snapshot of running processes on the host.\n\n## Source: kam193 (02334bfe46d6509e7900323066c5bb2eda0d5a34a6906cee5ccca3abaecb3ade)\nDuring installation, the package exfiltrates env variables\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-06-ip-rotat\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - exfiltration-env-variables\n\n\n - typosquatting\n","modified":"2026-06-24T08:01:23.155052674Z","published":"2026-06-23T12:07:57Z","database_specific":{"iocs":{"domains":["gjampdwmdjmppwedtkpbbdkq05f6iiz6r.oast.fun"]},"malicious-packages-origins":[{"sha256":"f9b8be8a4e20e24b88630f331f4bdd7bc66e208558ece25843aecc7a8110b4b4","source":"kam193","modified_time":"2026-06-23T12:07:57.927156Z","versions":["0.0.1"],"id":"pypi/2026-06-ip-rotat/toorc","import_time":"2026-06-23T13:28:20.42407085Z"},{"import_time":"2026-06-23T19:40:40.275534309Z","source":"amazon-inspector","modified_time":"2026-06-23T18:58:00Z","versions":["0.0.1"],"id":"IN-MAL-2026-007334","sha256":"2cfd36909e089f17439dd3227c6f5ccef2fef2964dc26bbdbaaef0481b54615d"},{"sha256":"02334bfe46d6509e7900323066c5bb2eda0d5a34a6906cee5ccca3abaecb3ade","source":"kam193","modified_time":"2026-06-23T12:07:57.927156Z","versions":["0.0.1"],"id":"pypi/2026-06-ip-rotat/toorc","import_time":"2026-06-24T07:47:34.503935521Z"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/toorc"},{"type":"PACKAGE","url":"https://pypi.org/project/toorc/0.0.1/"}],"affected":[{"package":{"name":"toorc","ecosystem":"PyPI","purl":"pkg:pypi/toorc"},"versions":["0.0.1"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"e3e6401df3a293e4d7511661d7a71b6f6dace4b74bc9dd394c01647ae3848313","tlsh":"a8316207e0bf29291ec354a0558f03959bc0e3a32f6431fa71fc29191f0b129503b8af","path":"setup.py"}],"package_integrity":[{"hashes":{"blake2b_256":"8bffdd9a7245f0f8e1b80d434a0432079bd32d9e055a6e3472014d3eeaa593e9","md5":"87b8e80085e5c76fce43e6ee293a583d","sha256":"c8ead1ac2162b136fe0babfc1f6f34f4e3d9f499fc3f808e17db9ecf55e1ba5e"},"filename":"toorc-0.0.1-py3-none-any.whl"},{"hashes":{"blake2b_256":"3d0684e0af55f5e3ccf134f7fe1d2efed1369b8085f3ec68077daa0c3a2ef65b","md5":"2aea2d99b8acf3bf0a5734cbd7f77e84","sha256":"aa94fe4ea2cab90497da15cd24b5c24be34a29d8b7b1ae1cb5efbb2091f843d2"},"filename":"toorc-0.0.1.tar.gz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/toorc/MAL-2026-6290.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}