MAL-2026-10916

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-devplatform-client/MAL-2026-10916.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10916
Published
2026-07-18T14:13:52Z
Modified
2026-08-05T07:21:41.787795569Z
Summary
Malicious code in python-devplatform-client (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8daa66fc6fa92869318e5a544d82fab2d5dff870dc4c6784f28733f84441415a)

The package's setup.py copies a telemetry.pth file into site-packages so every Python interpreter startup on the host auto-imports telemetryinit, which spawns a daemon thread invoking telemetrytransport.Client.initialize(). That client selects a platform-keyed asset path (/pkg/package, /pkg/package-arm64, /pkg/loadermac, /pkg/package.exe) from a list of anonymous Cloudflare Workers mirrors (package-proxy.cf5oobworker.workers.dev, cf8oobworker/cf12oobworker/cf17-ddb/cf25-6eb.workers.dev), downloads the binary with no version pinning or hash verification, chmods it 0o755, and executes it (Windows uses ctypes.windll.kernel32 CreateProcess). A fallback ServiceDiscovery routine opens raw UDP sockets to 8.8.8.8/1.1.1.1 and issues TXT lookups against tin/tina/ldr/win.dl.well1.site, concatenating numbered subdomain segments and base64-decoding them to reconstruct download endpoints — a DNS-tunneled C2 channel that survives HTTP egress filtering. The package self-describes as a Sentry-style analytics SDK (Level, DSN, Envelope, Hub, DISABLETELEMETRY opt-out) with placeholder metadata (Author: Platform Engineering, Summary: Internal SDK module); the analytics surface is a cover story for the download-and-execute chain. The.pth mechanism persists execution outside the package's own import path, so uninstalling the package's modules does not stop the interpreter-startup hook until the.pth file itself is removed from site-packages.

Source: kam193 (2b75d4d8e3c822aa82b716e6752c0901447845d442973ce9bc35c78b9c81c78a)

Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from one of c..dl.well1[.]site domains, depending on the system. This record returns a number, which is then used to iterate over domains in the form <0...n>..dl.well1[.]site and reconstruct the encoded executable from their TXT records. The downloaded binary is then executed and removed afterward. Using a PTH file ensures persistence and runs on every Python start. In this campaign, versions 0.0.1 hold disarmed code (without the necessary configuration), which is completed in further updates.

This is a continuation of the 2026-07-haproxy-config-client campaign.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-andreiiiiiii_i

Reasons (based on the campaign):

  • The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • Downloads and executes a remote executable.

  • covering-tracks

  • persistence

  • abuses-pth

  • data-stored-in-dns

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-20T16:06:06.877551373Z",
            "source": "kam193",
            "versions": [
                "0.0.1",
                "8.5.3",
                "8.5.4"
            ],
            "id": "pypi/2026-07-andreiiiiiii_i/python-devplatform-client",
            "modified_time": "2026-07-20T14:11:29.731509Z",
            "sha256": "00edd685ee9e9d7b4bab294f11c583434d683b963af5df00fbb1c4eb6df176e0"
        },
        {
            "import_time": "2026-07-20T17:01:49.035133256Z",
            "source": "kam193",
            "versions": [
                "0.0.1",
                "8.5.3",
                "8.5.4"
            ],
            "id": "pypi/2026-07-andreiiiiiii_i/python-devplatform-client",
            "modified_time": "2026-07-20T14:11:29.731509Z",
            "sha256": "2b75d4d8e3c822aa82b716e6752c0901447845d442973ce9bc35c78b9c81c78a"
        },
        {
            "import_time": "2026-08-04T21:33:12.871719792Z",
            "source": "amazon-inspector",
            "versions": [
                "8.5.3"
            ],
            "id": "IN-MAL-2026-010997",
            "modified_time": "2026-08-04T21:17:22Z",
            "sha256": "6d5a2ab0ca1218bc9891e144175e097c4971783defbb7dbfc5effe0aacb4a4f0"
        },
        {
            "import_time": "2026-08-04T21:33:12.827203784Z",
            "source": "amazon-inspector",
            "versions": [
                "8.5.4"
            ],
            "id": "IN-MAL-2026-010996",
            "modified_time": "2026-08-04T21:17:13Z",
            "sha256": "8daa66fc6fa92869318e5a544d82fab2d5dff870dc4c6784f28733f84441415a"
        },
        {
            "import_time": "2026-08-05T07:06:44.935903038Z",
            "id": "IN-MAL-2026-013387",
            "versions": [
                "0.0.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T06:15:52Z",
            "sha256": "f0ce9b74244d2517ccba2c761ce516e374def55d30df80d4ec108b9fbfe7a5c1"
        }
    ],
    "iocs": {
        "domains": [
            "package-proxy.cf8oobworker.workers.dev",
            "package-proxy.cf5oobworker.workers.dev",
            "package-proxy.cf25-6eb.workers.dev",
            "package-proxy.cf17-ddb.workers.dev",
            "win.dl.well1.site",
            "tina.dl.well1.site",
            "tin.dl.well1.site",
            "ldr.dl.well1.site"
        ]
    }
}
References
Credits

Affected packages

PyPI / python-devplatform-client

Package

Name
python-devplatform-client
View open source insights on deps.dev
Purl
pkg:pypi/python-devplatform-client

Affected ranges

Affected versions

0.*
0.0.1
8.*
8.5.3
8.5.4

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-devplatform-client/MAL-2026-10916.json"
indicators 
{
    "evidence_files": [
        {
            "path": "_telemetry_init.py",
            "tlsh": "b6d1a627ed151d72c547e3a698a6d1a1e32b59132e907078bddc831c1f8822782ff5bd",
            "sha256": "ca829c0a64e5aae78bc2e93aeb6897b5b3a4b0b60d2266ef1ffca4aed68ed532"
        },
        {
            "path": "_telemetry_transport.py",
            "tlsh": "7ab351a6e42a6c62c247d82a4c97f143772f6c53160c64787dfc825c2f59729c2f6ee8",
            "sha256": "d93b3cc1b6425b5af5d7d3820010fc1672c6dc25958f7394ebb2827863ad7b2f"
        },
        {
            "path": "PKG-INFO",
            "tlsh": "b311ab241ad2d93576f3060b6982c2b7c1728691298bb04cb8f303dd8a69d98c77e33d",
            "sha256": "37370825619f814f8389ef9352ccdd45928f8b282db988265b678842133344f9"
        }
    ],
    "package_integrity": [
        {
            "filename": "python_devplatform_client-8.5.3.tar.gz",
            "hashes": {
                "sha256": "cf3c369ebc1c0298a03ed9a00d2a7eb74dbbd2e67dd7efbca6766eb2c8046778",
                "blake2b_256": "5372698bea5a418fbb54ef83d5d8a1c00ceda1d321770012ac65c1d9ce6a31e7",
                "md5": "c3ce1c6ea0946287efb03602c6e0b747"
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]