MAL-2026-10865

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/kimitalk/MAL-2026-10865.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10865
Published
2026-07-20T05:12:24Z
Modified
2026-08-04T23:05:47Z
Summary
Malicious code in kimitalk (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (94983bf77f2b110f03fdd52385dfc4d215ad082666b1ac482c805062605c8d35)

The package presents itself as a 'Kimi' chat runtime but bundles a 32MB ELF binary at resources/kimichat that is ForgeMiner 1.4.1, a CUDA GPU cryptominer supporting KawPow/Pearl/Xelis/Cryptix algorithms (embedded strings include 'ForgeMiner/1.4.1', 'mining.authorize', 'mining.subscribe', 'pearl.set_mining'). The kimitalk-run console_script defined by the package invokes core.py's run(), which executes subprocess.run(['bash', str(launcher),...]) against a bundled start.sh. start.sh exports FORGE_WALLET=prl1p2jan4dvkdfkt5r3pra7z96axrxjyjcgat9w7ldetlcy9wffm569sc9ux2t and POOL=45.151.62.119:3361 and then chmods and executes./kimitalk, directing the installer's GPU/CPU compute to a Pearl (PRL) payout address controlled by the package author via a Stratum pool at 45.151.62.119:3361. The advertised chat-runtime purpose is a cover story; the actual behavior converts the installer's hardware and electricity into cryptocurrency for the author with no in-package mechanism for the user to redirect payout.

Source: kam193 (f48f2e540e85a647f55ad2b8758c8cca9d9a6105a72058870e59d4a410c83c9f)

In this campaign, packages use names similar to popular services (e.g. Kimi AI) to deploy cryptominer.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-kimichat

Reasons (based on the campaign):

  • cryptominer
Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-07-kimichat/kimitalk",
            "import_time": "2026-07-20T06:05:22.553621945Z",
            "modified_time": "2026-07-20T05:12:24.312543Z",
            "sha256": "f48f2e540e85a647f55ad2b8758c8cca9d9a6105a72058870e59d4a410c83c9f",
            "source": "kam193",
            "versions": [
                "0.1.0",
                "0.1.1",
                "0.1.2"
            ]
        },
        {
            "id": "pypi/2026-07-kimichat/kimitalk",
            "import_time": "2026-07-20T20:04:39.243818085Z",
            "modified_time": "2026-07-20T05:12:24.312543Z",
            "sha256": "b0bf13b40cfd82ba1c3a7212b86371b6708168dff820573dcafec926a2956545",
            "source": "kam193",
            "versions": [
                "0.1.0",
                "0.1.1",
                "0.1.2"
            ]
        },
        {
            "id": "IN-MAL-2026-011114",
            "import_time": "2026-08-04T22:29:59.965042973Z",
            "modified_time": "2026-08-04T21:34:32Z",
            "sha256": "457a29dcd199162d8ddf57e8b0e4de200a980ab80cee881e46952965aa8861b9",
            "source": "amazon-inspector",
            "versions": [
                "0.1.2"
            ]
        },
        {
            "id": "IN-MAL-2026-011256",
            "import_time": "2026-08-04T22:30:07.540618397Z",
            "modified_time": "2026-08-04T21:55:01Z",
            "sha256": "86975a0832868cd75811cc38c1c0b9158c4ecf4344e2e37f41c98cf87837af1a",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-011159",
            "import_time": "2026-08-04T22:30:02.419758249Z",
            "modified_time": "2026-08-04T21:41:01Z",
            "sha256": "94983bf77f2b110f03fdd52385dfc4d215ad082666b1ac482c805062605c8d35",
            "source": "amazon-inspector",
            "versions": [
                "0.1.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / kimitalk

Package

Name
kimitalk
View open source insights on deps.dev
Purl
pkg:pypi/kimitalk

Affected ranges

Affected versions

0.*
0.1.0
0.1.1
0.1.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "kimitalk/resources/start.sh",
            "sha256": "8d2e94a8e16640d49b927f4de37d75aa25fc255dd8fa64acf3a6e5c57f49565e",
            "tlsh": "2f3165c36d080231451e7728290679ca1e5830775a4b3299bbce77b1a30fba44962cb2"
        }
    ],
    "package_integrity": [
        {
            "filename": "kimitalk-0.1.2-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "6df9680b26d9c70a6504e5c77cec455beceac7a08f05bc0ee934698e3f591fd1",
                "md5": "d342e4aaa77e73e9fec53210502ffcee",
                "sha256": "c9dcb271922bd117caeec1106e30d2a0df0d7fbbeb44be7a2d4182913b84605c"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/kimitalk/MAL-2026-10865.json"