MAL-2026-11031

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/govapkg/MAL-2026-11031.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11031
Published
2026-07-23T20:06:38Z
Modified
2026-07-28T14:37:29.164665393Z
Summary
Malicious code in govapkg (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf)

govapkg presents itself as a client for pkg.go.dev but on any use of its public API (get/package/module) invokes an internal helper govpkg.internal.normalizeHelper that base64-decodes a hidden URL to https://teeny-cent.surge.sh/client, downloads the response to ~/.local/bin/systemdserv, sets the executable bit, and spawns it detached via subprocess.Popen with startnew_session=True. The helper then writes ~/.config/autostart/systemdserv.desktop with Exec pointing at the dropped binary and Name 'Systemd Service Manager', establishing user-level persistence that re-launches the attacker binary on every desktop login. The download destination is an anonymous static-hosting domain unrelated to the package's advertised Go documentation purpose, the URL is base64-obfuscated to evade string scans, and no hash or signature is verified on the fetched bytes.

Source: kam193 (c23fe2f960316aca782b4319dac6f960d4397ec40428d34e28b1769cd0bff4b4)

When using the provided functionality, the package silently downloads a malicious executable and ensures its persistence disguised as a system service. The binary connects with telegra[.]ph. It appears that the contacted URL is built from the template https://api.telegra.ph/getPage/whisperer-MM-DD and contains an advertisement for a Telegram channel.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-govpkg

Reasons (based on the campaign):

  • Downloads and executes a remote executable.

  • action-hidden-in-lib-usage

  • persistence

Database specific 
{
    "iocs": {
        "domains": [
            "teeny-cent.surge.sh"
        ],
        "urls": [
            "https://temp.sh/NBZzm/client",
            "https://teeny-cent.surge.sh/client"
        ]
    },
    "malicious-packages-origins": [
        {
            "modified_time": "2026-07-23T20:06:38.840554Z",
            "sha256": "aa79a3120abb07b8e73d784c41300631c6a9b9654a653a916bddb4bb86bbc088",
            "import_time": "2026-07-23T20:57:19.188096397Z",
            "id": "pypi/2026-07-govpkg/govapkg",
            "versions": [
                "0.1.0"
            ],
            "source": "kam193"
        },
        {
            "modified_time": "2026-07-23T20:06:38.840554Z",
            "sha256": "c23fe2f960316aca782b4319dac6f960d4397ec40428d34e28b1769cd0bff4b4",
            "import_time": "2026-07-23T21:29:54.864262779Z",
            "id": "pypi/2026-07-govpkg/govapkg",
            "versions": [
                "0.1.0"
            ],
            "source": "kam193"
        },
        {
            "import_time": "2026-07-28T14:20:01.997158306Z",
            "sha256": "6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf",
            "modified_time": "2026-07-28T13:43:42Z",
            "id": "IN-MAL-2026-010971",
            "versions": [
                "0.1.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

PyPI / govapkg

Package

Name
govapkg
View open source insights on deps.dev
Purl
pkg:pypi/govapkg

Affected ranges

Affected versions

0.*
0.1.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/govapkg/MAL-2026-11031.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "e12c648689cc17ee89be1c21037bd8fe3a0af8be2f584069fc2a8b3a02dd359f",
            "tlsh": "3221f157c686397082c68270145265294aaef81f9b878830bbbd9bd08f85d2e50a9a7d",
            "path": "govpkg/_internal.py"
        }
    ],
    "package_integrity": [
        {
            "filename": "govapkg-0.1.0-py3-none-any.whl",
            "hashes": {
                "sha256": "cdec7b16aa6e85a09feec3e97573c0255d0219ea9c3072a41a423df1b8a18ee5",
                "blake2b_256": "7b51a36d1082f52d9c60bd7ca1c9a7bdd93167041f66eb51f31e29ea52a06f93",
                "md5": "e19335475dc2327005674ecd6b9297f8"
            }
        }
    ]
}