MAL-2026-10757

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dde-common/MAL-2026-10757.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10757
Published
2026-07-16T18:43:48Z
Modified
2026-07-28T14:37:28Z
Summary
Malicious code in dde-common (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f875cacd68379cbaaa066adac089dc3c403fd532a0e73ba932cf35e0562ff476)

setup.py installs a telemetry.pth file into site-packages containing import _telemetry_init, which causes Python's site.py to load the bootstrap module on every interpreter startup, independent of whether anything imports dde-common. _telemetry_init spawns a daemon thread that selects a platform-specific asset path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) and fetches an opaque native binary from a rotation of Cloudflare Workers hosts (package-proxy.cf5oobworker.workers.dev, package-proxy.cf8oobworker.workers.dev, package-proxy.cf12oobworker.workers.dev, package-proxy.cf17-ddb.workers.dev, package-proxy.cf25-6eb.workers.dev). On POSIX the file is chmod 0o755'd and executed; on Windows it is launched via ctypes.windll.kernel32 CreateProcess with STARTUPINFO/PROCESS_INFORMATION. A DNS-TXT covert channel provides a fallback distribution path: custom UDP queries to 8.8.8.8/1.1.1.1 retrieve numbered TXT chunks from tin/tina/ldr/win.dl.well1.site, which are concatenated and base64-decoded to reconstruct the payload, bypassing HTTP-based network controls. Package metadata frames the module as an 'Internal SDK' by 'Platform Engineering' and shipped code exposes a Sentry-lookalike analytics API surface (Client/Hub/Envelope/Breadcrumb/DSN) that is never exercised — the only reachable code path fetches and executes a native binary from anonymous infrastructure with no hash or signature verification.

Source: kam193 (c0eb18950d3479b8ce79d01c50f1eaf3e56373dd8b66feef0d4aa8d12f78f528)

Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from one of c..dl.well1[.]site domains, depending on the system. This record returns a number, which is then used to iterate over domains in the form <0...n>..dl.well1[.]site and reconstruct the encoded executable from their TXT records. The downloaded binary is then executed and removed afterward. Using a PTH file ensures persistence and runs on every Python start. In this campaign, versions 0.0.1 hold disarmed code (without the necessary configuration), which is completed in further updates.

This is a continuation of the 2026-07-haproxy-config-client campaign.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-andreiiiiiii_i

Reasons (based on the campaign):

  • The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • Downloads and executes a remote executable.

  • covering-tracks

  • persistence

  • abuses-pth

  • data-stored-in-dns

Database specific 
{
    "iocs": {
        "domains": [
            "package-proxy.cf8oobworker.workers.dev",
            "package-proxy.cf5oobworker.workers.dev",
            "package-proxy.cf25-6eb.workers.dev",
            "package-proxy.cf17-ddb.workers.dev",
            "win.dl.well1.site",
            "tina.dl.well1.site",
            "tin.dl.well1.site",
            "ldr.dl.well1.site"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010763",
            "import_time": "2026-07-16T18:54:03.332745318Z",
            "modified_time": "2026-07-16T18:43:48Z",
            "sha256": "8a9c1ea29800a587d513d49d1ed9ddd14d9cf9d246e6622f57389e9c91606ad5",
            "source": "amazon-inspector",
            "versions": [
                "0.0.1"
            ]
        },
        {
            "id": "pypi/2026-07-andreiiiiiii_i/dde-common",
            "import_time": "2026-07-20T16:06:06.875605183Z",
            "modified_time": "2026-07-20T14:11:29.524568Z",
            "sha256": "cbe186f2410a3e7faa1960757b2d48d3a714b1b308e893fc2d3ea1d97214d28b",
            "source": "kam193",
            "versions": [
                "0.0.1",
                "8.5.3",
                "8.5.4"
            ]
        },
        {
            "id": "pypi/2026-07-andreiiiiiii_i/dde-common",
            "import_time": "2026-07-20T17:01:49.032636368Z",
            "modified_time": "2026-07-20T14:11:29.524568Z",
            "sha256": "c0eb18950d3479b8ce79d01c50f1eaf3e56373dd8b66feef0d4aa8d12f78f528",
            "source": "kam193",
            "versions": [
                "0.0.1",
                "8.5.3",
                "8.5.4"
            ]
        },
        {
            "id": "IN-MAL-2026-010968",
            "import_time": "2026-07-28T14:20:01.865073466Z",
            "modified_time": "2026-07-28T13:43:16Z",
            "sha256": "4380f679523a900b31d18f3e5657de2754e92b5550b8f22770d29ec7d2a6c90c",
            "source": "amazon-inspector",
            "versions": [
                "8.5.3"
            ]
        },
        {
            "id": "IN-MAL-2026-010970",
            "import_time": "2026-07-28T14:20:01.951369951Z",
            "modified_time": "2026-07-28T13:43:32Z",
            "sha256": "f875cacd68379cbaaa066adac089dc3c403fd532a0e73ba932cf35e0562ff476",
            "source": "amazon-inspector",
            "versions": [
                "8.5.4"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / dde-common

Package

Name
dde-common
View open source insights on deps.dev
Purl
pkg:pypi/dde-common

Affected ranges

Affected versions

0.*
0.0.1
8.*
8.5.3
8.5.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_telemetry_init.py",
            "sha256": "34a3a05b9ae6c9efd62a5b84aba9517741ce3cffaba4296bc02c45fdfe8ac854",
            "tlsh": "aed11c27ed0f2c328172d75e9899d0f0f72643035ab192577cac831d2f7851782ae5ae"
        },
        {
            "path": "_telemetry_transport.py",
            "sha256": "3b2e157d9383b96d3591c354bd80acb2ac525529f18fb1522fe49f22520ea650",
            "tlsh": "04b33cb6ed1bac228177c91e9c86e047f72a4753222c614779bc826c2f74715c2e4eed"
        },
        {
            "path": "src/dde_common/__init__.py",
            "sha256": "fbe0208e6454b37990122c5e72a5290abbf1bc99b2ed22cd037e3583dbbbf8d2",
            "tlsh": "fde06da85d4fe82241b5cc5e8d91b443eb5e4a47552e1093717cb11a1f34e14d1d89f9"
        }
    ],
    "package_integrity": [
        {
            "filename": "dde_common-0.0.1.tar.gz",
            "hashes": {
                "blake2b_256": "f0a28bb8bbc2f273ad822c8d907b83ca1e605879506d67c3df21ec8d6a9ef16d",
                "md5": "15c39fb5942de814f4ee0b3df71f769e",
                "sha256": "ae14999a0b7c27b34784611fd0e21b40e2065848fc2ac36c845c29d1c453b010"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dde-common/MAL-2026-10757.json"