MAL-2026-10974

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/rasterkit/MAL-2026-10974.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10974
Published
2026-07-21T06:01:48Z
Modified
2026-08-05T06:36:44.422940869Z
Summary
Malicious code in rasterkit (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (115c87298c4a239bd4954e39a155929c2480510343aefe1fa7c0b631b467af6b)

The rasterkit 1.0.2 distribution installs its modules under the top-level PIL/ package name owned by Pillow. top_level.txt declares PIL and the wheel's RECORD places PIL/__init__.py, PIL/Image.py, PIL/_binary.py, and related files under this publisher's control, so an environment that installs rasterkit alongside or in place of Pillow will resolve from PIL import Image to code shipped by rasterkit. In addition, PIL/_binary.py defines a bmp_plane_tail function that walks the trailing pixels of a bundled 24-bpp bitmap at PIL/_data/demo.bmp (~2.3 MB), reads one byte per pixel, XORs each byte with a caller-supplied key, and returns the concatenated buffer optionally split into segments. PIL/_data/__init__.py hardcodes exact reconstruction parameters (DEMO_TAIL_COUNT=5092, DEMO_TAIL_MIX=42, DEMO_TAIL_SEGMENTS=[3379,1713]) that recover two specific hidden buffers from the bundled BMP. No code path in this version invokes the decoder at install or import time, and no exec/compile/__import__ sink for the recovered bytes is present in the shipped files, so there is no traced auto-execution of the hidden payload. The combination — namespace occupation of Pillow's PIL plus a stego decoder with fixed parameters over a bundled carrier — matches the shape of a two-stage dropper staging component where a separate module would supply the execution sink.

Source: kam193 (a6eea31746baa37e55a76fec564eda1852839be005d53ae1e24bf2b9ea4c7875)

This package is a clone of Pillow library with malicious code hidden in an image using steganography. The code is the used in a dependant package to install an SSH backdoor.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-textwrap-toolkit-stager

Reasons (based on the campaign):

  • backdoor

  • obfuscation

  • crypto-related

  • Downloads and executes a remote malicious script.

  • exfiltration-crypto

Database specific 
{
    "iocs": {
        "ips": [
            "194.5.152.9"
        ],
        "urls": [
            "http://194.5.152.9:5555/report",
            "http://194.5.152.9:8080/hacks/textwrap-toolkit/textwrap_toolkit/__init__.py",
            "http://194.5.152.9:5555/tao"
        ]
    },
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.0",
                "1.0.2",
                "1.0.4"
            ],
            "source": "kam193",
            "sha256": "a6eea31746baa37e55a76fec564eda1852839be005d53ae1e24bf2b9ea4c7875",
            "modified_time": "2026-07-21T06:01:48.065059Z",
            "import_time": "2026-07-21T07:23:25.393717105Z",
            "id": "pypi/2026-06-textwrap-toolkit-stager/rasterkit"
        },
        {
            "versions": [
                "1.0.2"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-012893",
            "modified_time": "2026-08-05T05:04:25Z",
            "import_time": "2026-08-05T06:00:16.757286053Z",
            "sha256": "115c87298c4a239bd4954e39a155929c2480510343aefe1fa7c0b631b467af6b"
        },
        {
            "versions": [
                "1.0.4"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-012895",
            "modified_time": "2026-08-05T05:04:41Z",
            "import_time": "2026-08-05T06:00:17.196099684Z",
            "sha256": "403e75910868428fd3630c92cc526be873a68fbbf7342f9ae22f98c558c44617"
        },
        {
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "sha256": "f700fd4144468c1dd037694194a8e6de7dc414b1eb478bec2fb7545d69fea426",
            "modified_time": "2026-08-05T05:39:29Z",
            "import_time": "2026-08-05T06:00:46.386220512Z",
            "id": "IN-MAL-2026-013139"
        }
    ]
}
References
Credits

Affected packages

PyPI / rasterkit

Package

Name
rasterkit
View open source insights on deps.dev
Purl
pkg:pypi/rasterkit

Affected ranges

Affected versions

1.*
1.0.0
1.0.2
1.0.4

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "ae266aae4fa1c99aa1e5fd59d19c228b774a7f112c07286ef5c53d20e0c5f8d6",
            "path": "rasterkit-1.0.2.dist-info/top_level.txt"
        },
        {
            "tlsh": "3fa13096d821fad79b05806f8196e4193708f77733d0e2a87c9cad782f4681de9b52cc",
            "sha256": "d9789ccd96ff3992518c04854b73aa48df3422ba00a326b602686160820b1647",
            "path": "PIL/_binary.py"
        }
    ],
    "package_integrity": [
        {
            "filename": "rasterkit-1.0.2-py3-none-any.whl",
            "hashes": {
                "md5": "2379e6301d7f353c469cdbca7ae1c64a",
                "sha256": "0163e7cd219763934c2bb5c0487faa26ba25f98b01c38c4e2e8d47b66fea985e",
                "blake2b_256": "ad082917528ba7498be33836657533b7e185d364812db1a205c06b3077855dbe"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/rasterkit/MAL-2026-10974.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]