MAL-2026-10191

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/data-harvester/MAL-2026-10191.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10191
Published
2026-07-12T08:16:33Z
Modified
2026-07-13T07:47:05.299994700Z
Summary
Malicious code in data-harvester (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (21c2e2c21d9afac9277d95589962d33a09651a5b6ef7e0b3c9e07aee56af213f)

On first import, data_harvester/init.py decodes a base64-embedded ~486KB Linux ELF, writes it to ~/.config/.npm-cache/snapd-network, sets mode 0777, and installs a user crontab entry (0 */12 * * *) to re-execute it every 12 hours. The binary is disguised under a system-service-like name in a hidden.npm-cache directory that maps to no real npm or snapd path. The init code then recursively removes the package's own dist-info/egg-info and pycache directories, erasing evidence while the dropped binary and cron entry persist.

Source: kam193 (d9ff3c2a82fba71167baaab535551bcb60a32bf4eb1bdd355ef3314d493771c4)

The package embeds an executable stealing cryptocurrency wallets data. During import, code saves the executable under a name suggesting system utility and configures cron to run it periodically. The exfiltrated data is encrypted using embedded RSA code before uploading to file-sharing services or IPFS.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-py-base58

Reasons (based on the campaign):

  • crypto-related

  • exfiltration-crypto

  • persistence

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-07-12T08:16:33.478451Z",
            "source": "kam193",
            "sha256": "d9ff3c2a82fba71167baaab535551bcb60a32bf4eb1bdd355ef3314d493771c4",
            "import_time": "2026-07-12T09:13:05.568854656Z",
            "id": "pypi/2026-07-py-base58/data-harvester",
            "versions": [
                "0.3.1"
            ]
        },
        {
            "source": "amazon-inspector",
            "import_time": "2026-07-13T07:40:10.928062214Z",
            "sha256": "21c2e2c21d9afac9277d95589962d33a09651a5b6ef7e0b3c9e07aee56af213f",
            "modified_time": "2026-07-13T06:35:34Z",
            "id": "IN-MAL-2026-009820",
            "versions": [
                "0.3.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / data-harvester

Package

Name
data-harvester
View open source insights on deps.dev
Purl
pkg:pypi/data-harvester

Affected ranges

Affected versions

0.*
0.3.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/data-harvester/MAL-2026-10191.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "data_harvester-0.3.1-py3-none-any.whl",
            "hashes": {
                "md5": "f9c70092df58a122e7373d5afc9bed02",
                "blake2b_256": "ce6c6e9bdc52dad3f62346725749f8206846f85a16f0b361c3bcc6a610d93c49",
                "sha256": "efa3d6e3e3cc8f0ca609c34fb8239cd40b547fdc6cb7a8acb682864dfc6db239"
            }
        },
        {
            "filename": "data_harvester-0.3.1.tar.gz",
            "hashes": {
                "md5": "8ea2d3ab041fbc8f1b35cfb0a1e4bfe0",
                "blake2b_256": "cfbc0bc685f19b4c05cac1f51876dbf3c6def8587f37b4f343e292be7634d69c",
                "sha256": "fafe47f60a81a5add96078223621b5705b9b13f992f97aeba4627fbe268453ca"
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]