MAL-2026-10917

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/tinkoff-cloud-apis-internal/MAL-2026-10917.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10917
Published
2026-07-18T14:14:02Z
Modified
2026-08-05T06:36:44Z
Summary
Malicious code in tinkoff-cloud-apis-internal (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (421b85b858849bbf116303f2dc2740180df602dfc162f7ce7fa109e4c39b07ff)

The package installs a telemetry.pth file into site-packages via a custom install cmdclass; the.pth line imports _telemetry_init, causing every subsequent Python interpreter startup on the host to spawn a background thread that fetches and executes attacker-controlled binaries. The bootstrap resolves platform-specific payload paths (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) from a rotating set of anonymous Cloudflare Workers mirrors (package-proxy.cf5oobworker.workers.dev, cf8oobworker, cf12oobworker, cf17-ddb, cf25-6eb.workers.dev) with a DNS-over-UDP TXT covert-channel fallback (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site queried against 8.8.8.8/1.1.1.1, base64-reassembled from chunked TXT records). Downloaded bytes are chmod 0o755 and executed on Unix, or launched via ctypes.windll.kernel32.CreateProcess with hand-built STARTUPINFO/PROCESS_INFORMATION structs on Windows, with no signature or hash verification. The module mimics the Sentry Python SDK surface (DSN, Envelope, Hub, Scope, BreadcrumbRecorder, capture_message, capture_exception) and self-describes as a 'Platform analytics SDK' with a DISABLE_TELEMETRY opt-out; the package name tinkoff-cloud-apis-internal and generic 'Platform Engineering' author metadata impersonate internal infrastructure of a well-known Russian financial-services provider.

Source: kam193 (30caca1d5e67322644a0eb6cf8098151d975415baab826d14a0bba75117ae95e)

Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from one of c..dl.well1[.]site domains, depending on the system. This record returns a number, which is then used to iterate over domains in the form <0...n>..dl.well1[.]site and reconstruct the encoded executable from their TXT records. The downloaded binary is then executed and removed afterward. Using a PTH file ensures persistence and runs on every Python start. In this campaign, versions 0.0.1 hold disarmed code (without the necessary configuration), which is completed in further updates.

This is a continuation of the 2026-07-haproxy-config-client campaign.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-andreiiiiiii_i

Reasons (based on the campaign):

  • The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • Downloads and executes a remote executable.

  • covering-tracks

  • persistence

  • abuses-pth

  • data-stored-in-dns

Database specific 
{
    "iocs": {
        "domains": [
            "package-proxy.cf8oobworker.workers.dev",
            "package-proxy.cf5oobworker.workers.dev",
            "package-proxy.cf25-6eb.workers.dev",
            "package-proxy.cf17-ddb.workers.dev",
            "win.dl.well1.site",
            "tina.dl.well1.site",
            "tin.dl.well1.site",
            "ldr.dl.well1.site"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-07-andreiiiiiii_i/tinkoff-cloud-apis-internal",
            "import_time": "2026-07-20T16:06:06.878366037Z",
            "modified_time": "2026-07-20T14:10:25.659177Z",
            "sha256": "b21d348a58a9c27b05aa66e8571b6a1ca17a36362868886d68e96d69f0c90aec",
            "source": "kam193",
            "versions": [
                "0.0.1",
                "8.5.3",
                "8.5.4"
            ]
        },
        {
            "id": "pypi/2026-07-andreiiiiiii_i/tinkoff-cloud-apis-internal",
            "import_time": "2026-07-20T17:01:49.035929708Z",
            "modified_time": "2026-07-20T14:10:25.659177Z",
            "sha256": "30caca1d5e67322644a0eb6cf8098151d975415baab826d14a0bba75117ae95e",
            "source": "kam193",
            "versions": [
                "0.0.1",
                "8.5.3",
                "8.5.4"
            ]
        },
        {
            "id": "IN-MAL-2026-011029",
            "import_time": "2026-08-04T21:33:14.383393162Z",
            "modified_time": "2026-08-04T21:22:04Z",
            "sha256": "421b85b858849bbf116303f2dc2740180df602dfc162f7ce7fa109e4c39b07ff",
            "source": "amazon-inspector",
            "versions": [
                "8.5.4"
            ]
        },
        {
            "id": "IN-MAL-2026-011028",
            "import_time": "2026-08-04T21:33:14.356661937Z",
            "modified_time": "2026-08-04T21:21:54Z",
            "sha256": "8f8e59152713cec1f0fac7905f685092e0ca5c0034edfe45af488e3455b74934",
            "source": "amazon-inspector",
            "versions": [
                "8.5.3"
            ]
        },
        {
            "id": "IN-MAL-2026-012880",
            "import_time": "2026-08-05T06:00:15.280379531Z",
            "modified_time": "2026-08-05T05:02:36Z",
            "sha256": "466e0e181c85abb2ef68b04bc6d00946dee32ee85d6d3cb722283d504ff16955",
            "source": "amazon-inspector",
            "versions": [
                "0.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / tinkoff-cloud-apis-internal

Package

Name
tinkoff-cloud-apis-internal
View open source insights on deps.dev
Purl
pkg:pypi/tinkoff-cloud-apis-internal

Affected ranges

Affected versions

0.*
0.0.1
8.*
8.5.3
8.5.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_telemetry_init.py",
            "sha256": "ddf96bf8164a309c67582378dc63c35c042c37edddd8e20986529696ca60a2d4",
            "tlsh": "73d19526ec151d76c547e3a6a8a6d1a1e32759132e906078bddcc31c1f8822782ff5bd"
        },
        {
            "path": "_telemetry_transport.py",
            "sha256": "d93b3cc1b6425b5af5d7d3820010fc1672c6dc25958f7394ebb2827863ad7b2f",
            "tlsh": "7ab351a6e42a6c62c247d82a4c97f143772f6c53160c64787dfc825c2f59729c2f6ee8"
        }
    ],
    "package_integrity": [
        {
            "filename": "tinkoff_cloud_apis_internal-8.5.4.tar.gz",
            "hashes": {
                "blake2b_256": "d511cddc97c18babda826b6a12b4265fd8e63a30e6b1af1ebe8e70d280fa1da9",
                "md5": "f72b7e4b64f71e18bc68b593a028edeb",
                "sha256": "fea22336694d6febcb20265f54c79c79fd933832b4d55639d137f8544a4d8c2d"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/tinkoff-cloud-apis-internal/MAL-2026-10917.json"