MAL-2026-10756

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/darkglitch/MAL-2026-10756.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10756
Published
2026-07-16T18:43:08Z
Modified
2026-07-23T07:53:01Z
Summary
Malicious code in darkglitch (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5a84fec55fc625d5e2b337aafe5a9a95ff30c47403241c59dbb33543ec97311a)

The package installs a listener CLI (darkglitch -l -b) that opens a WebSocket to the hardcoded signaling host malware-signal.vercel.app and joins the hardcoded room D4RKGLI7CH (core/data/client.py: HOST/ROOM constants). Incoming remote-command messages are executed on the host via subprocess.run(command, shell=True, capture_output=True,...) inside _process_command_request, with stdout/stderr returned to the sender. transfer_utils/transfer.py extends this channel with arbitrary file upload/download: build_transfer_command emits a python3 heredoc that base64-encodes any source path's bytes for exfiltration, and the upload branch base64-decodes attacker-supplied bytes to any target path. The README instructs users to build the listener as darkglitch_listener.exe with PyInstaller's --noconsole flag so no window appears, and internal modules (malware_signal, injection_utils, helper.py) describe themselves as a "post-exploitation framework" and "Advanced Command & Control Framework". The room identifier is shared, so any party who knows it can issue commands to any host running the listener.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010758",
            "import_time": "2026-07-16T18:54:03.060429874Z",
            "modified_time": "2026-07-16T18:43:08Z",
            "sha256": "6d02eb8be388433532783a7bf88864824b50756b7ced4f8728721866740c5df1",
            "source": "amazon-inspector",
            "versions": [
                "1.2.0"
            ]
        },
        {
            "id": "IN-MAL-2026-010855",
            "import_time": "2026-07-22T20:59:17.077490696Z",
            "modified_time": "2026-07-22T20:40:15Z",
            "sha256": "5a84fec55fc625d5e2b337aafe5a9a95ff30c47403241c59dbb33543ec97311a",
            "source": "amazon-inspector",
            "versions": [
                "1.2.9"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / darkglitch

Package

Name
darkglitch
View open source insights on deps.dev
Purl
pkg:pypi/darkglitch

Affected ranges

Affected versions

1.*
1.2.0
1.2.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "command_injection/injector.py",
            "sha256": "6ab028325a6c5f179e95351eb30fcf0e53c09bbde826bac31cc0a50435a8f472",
            "tlsh": "3af115d589be5c15c2875099a8a6b3521101bb032f08357a7dec76a81f4c32ad5b4fde"
        },
        {
            "path": "core/config.py",
            "sha256": "0f7e2a4880c8807b0ad1212de92751b2f6c031cd6cc4bea80a07ec2e9a27ea8d",
            "tlsh": "25a012632325407501498c44c007f80c730573686481025064011c49d9105d00392101"
        },
        {
            "path": "command/run/build_exe.py",
            "sha256": "5768ef6be70ecad0c0babae00a11c850915399f0c1895b6982d87a122311f1e1",
            "tlsh": "9a41512aca356e7106c3ca5e68b303d3c556d01709d0312534dec7982f9ba8e4276bed"
        }
    ],
    "package_integrity": [
        {
            "filename": "darkglitch-1.2.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "c879c44ed1ab8914613126df674f751601713f1774dc647643c42bacc0967b64",
                "md5": "c1c4ae29bbf2b29c0939b20b4e4ead4c",
                "sha256": "c216762c6f26c96dca1abddc755209faa25333b94f90e0299065a63013fe181f"
            }
        },
        {
            "filename": "darkglitch-1.2.0.tar.gz",
            "hashes": {
                "blake2b_256": "9b8a7b6f1367bf24684cc67880b11b17bb702134f9de31d757b9910cac058c22",
                "md5": "fa94b3faf1d48c41e07aada064153bc7",
                "sha256": "28e7cadb2ede0b6852027769fb6072e8af2634175304ea22adc08de08e684ed9"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/darkglitch/MAL-2026-10756.json"