MAL-2026-10754

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/airflow-provider-spirit/MAL-2026-10754.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10754
Published
2026-07-16T18:41:57Z
Modified
2026-07-28T14:37:28.981032445Z
Summary
Malicious code in airflow-provider-spirit (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (84edc3b5fdf650aec875a1381b60bf2bb811f0c813ca6841052730fcee025bc3)

The package is published as an Airflow provider but ships no provider code. setup.py installs telemetry.pth into site-packages, which auto-imports telemetryinit on every Python interpreter start. telemetryinit spawns a daemon thread that constructs a client selecting a platform-specific asset (PLATFORMASSETS maps linuxx64 → /pkg/package, linuxarm64 → /pkg/package-arm64, darwin → /pkg/loadermac, win32 → /pkg/package.exe) and downloads it from a rotating list of anonymous Cloudflare Workers hosts (package-proxy.cf5oobworker.workers.dev, package-proxy.cf8oobworker.workers.dev, package-proxy.cf12oobworker.workers.dev, package-proxy.cf17-ddb.workers.dev, package-proxy.cf25-6eb.workers.dev). telemetrytransport.py writes the downloaded bytes to disk, sets 0o755 with os.chmod, and executes them — on Windows via ctypes.windll.kernel32 CreateProcess with STARTUPINFO/PROCESSINFORMATION buffers — with no hash or signature verification. A second delivery channel issues raw UDP DNS queries to 8.8.8.8/1.1.1.1 for TXT records at tin.dl.wel1.ru, tina.dl.wel1.ru, ldr.dl.wel1.ru, and win.dl.wel1.ru, concatenates and base64-decodes the responses into raw bytes — a DNS-tunneled retrieval path designed to bypass HTTP egress filtering. Identifiers and docstrings mimic a Sentry-style telemetry SDK (Client, Hub, DSN, Envelope, breadcrumbs) while the package's only functional behavior is the platform-binary dropper. Because the trigger is a.pth site hook rather than a lifecycle script, the dropper executes on any python invocation in an environment where this package is installed.

Source: kam193 (9b34b2a0cc52321dd89abbfd0036061560a1c0fa08f2a494a6a2a13566a8d84b)

Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from one of c..dl.well1[.]site domains, depending on the system. This record returns a number, which is then used to iterate over domains in the form <0...n>..dl.well1[.]site and reconstruct the encoded executable from their TXT records. The downloaded binary is then executed and removed afterward. Using a PTH file ensures persistence and runs on every Python start. In this campaign, versions 0.0.1 hold disarmed code (without the necessary configuration), which is completed in further updates.

This is a continuation of the 2026-07-haproxy-config-client campaign.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-andreiiiiiii_i

Reasons (based on the campaign):

  • The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • Downloads and executes a remote executable.

  • covering-tracks

  • persistence

  • abuses-pth

  • data-stored-in-dns

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "b565bd72c6acb3adb077ac7923ddf40d12a4922cb8bea5d22a43590e7c57d8e6",
            "import_time": "2026-07-16T18:54:02.665917251Z",
            "versions": [
                "0.0.1"
            ],
            "id": "IN-MAL-2026-010750",
            "modified_time": "2026-07-16T18:41:57Z",
            "source": "amazon-inspector"
        },
        {
            "sha256": "de30b355725bbb3e2266ac42ee2b911a0bc4f646d3c26125b5447108cf545dd0",
            "import_time": "2026-07-20T16:06:06.858199502Z",
            "versions": [
                "0.0.1",
                "8.5.3",
                "8.5.4"
            ],
            "id": "pypi/2026-07-andreiiiiiii_i/airflow-provider-spirit",
            "modified_time": "2026-07-20T14:11:29.939061Z",
            "source": "kam193"
        },
        {
            "import_time": "2026-07-20T17:01:49.029495854Z",
            "versions": [
                "0.0.1",
                "8.5.3",
                "8.5.4"
            ],
            "sha256": "9b34b2a0cc52321dd89abbfd0036061560a1c0fa08f2a494a6a2a13566a8d84b",
            "id": "pypi/2026-07-andreiiiiiii_i/airflow-provider-spirit",
            "modified_time": "2026-07-20T14:11:29.939061Z",
            "source": "kam193"
        },
        {
            "import_time": "2026-07-28T14:19:56.861152609Z",
            "versions": [
                "8.5.4"
            ],
            "sha256": "4ec5dbf4eb9341a2e18a4a36b0af67cd70e2438ba476e8a7a86d51458d42141e",
            "id": "IN-MAL-2026-010873",
            "modified_time": "2026-07-28T13:30:04Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "8.5.3"
            ],
            "sha256": "84edc3b5fdf650aec875a1381b60bf2bb811f0c813ca6841052730fcee025bc3",
            "import_time": "2026-07-28T14:19:56.947616932Z",
            "id": "IN-MAL-2026-010875",
            "modified_time": "2026-07-28T13:30:19Z",
            "source": "amazon-inspector"
        }
    ],
    "iocs": {
        "domains": [
            "package-proxy.cf8oobworker.workers.dev",
            "package-proxy.cf5oobworker.workers.dev",
            "package-proxy.cf25-6eb.workers.dev",
            "package-proxy.cf17-ddb.workers.dev",
            "win.dl.well1.site",
            "tina.dl.well1.site",
            "tin.dl.well1.site",
            "ldr.dl.well1.site"
        ]
    }
}
References
Credits

Affected packages

PyPI / airflow-provider-spirit

Package

Name
airflow-provider-spirit
View open source insights on deps.dev
Purl
pkg:pypi/airflow-provider-spirit

Affected ranges

Affected versions

0.*
0.0.1
8.*
8.5.3
8.5.4

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "airflow_provider_spirit-0.0.1.tar.gz",
            "hashes": {
                "sha256": "81559beccd362b44d45379a5d1d7684813f7b6626c4a8e8c6297dc6d73ccd4ce",
                "md5": "f30a8a03278a36f099ab4f3df297b91c",
                "blake2b_256": "2d61283587f7e15fee2912cd88dbb6613d2a13f236c8a3e37946e3874ce41795"
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "c6b596eb61bf2e9b8e9483c48b1d55c567cd221b9d3e038f7233ccfb71609531",
            "path": "setup.py",
            "tlsh": "2a21986b8ca5283055f5c9249d63c895fa641317bd20d48b7afc43083f792e2cb4b157"
        },
        {
            "sha256": "34a3a05b9ae6c9efd62a5b84aba9517741ce3cffaba4296bc02c45fdfe8ac854",
            "path": "_telemetry_init.py",
            "tlsh": "aed11c27ed0f2c328172d75e9899d0f0f72643035ab192577cac831d2f7851782ae5ae"
        },
        {
            "sha256": "3b2e157d9383b96d3591c354bd80acb2ac525529f18fb1522fe49f22520ea650",
            "path": "_telemetry_transport.py",
            "tlsh": "04b33cb6ed1bac228177c91e9c86e047f72a4753222c614779bc826c2f74715c2e4eed"
        },
        {
            "sha256": "69e4a325cdbb0cc2ac91818b2b551f024cc2614b8a272c00990919a820809842",
            "path": "src/airflow_provider_spirit/__init__.py",
            "tlsh": "89f0a0a89d5be82240b5cc5f5d61b843eb2d0a47491e1093717ca11e0f35e08c5c89e9"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/airflow-provider-spirit/MAL-2026-10754.json"