MAL-2026-11156

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/vtranalytic/MAL-2026-11156.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11156
Published
2026-07-28T13:42:28Z
Modified
2026-08-05T13:36:27Z
Summary
Malicious code in vtranalytic (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (897fa80f1d8a55ff480d6c7e7a71200ac31530a9f5d928389545b597c7b45903)

The package implements a full remote-administration toolkit controlled through a Telegram bot. It polls the Telegram Bot API at https://api.telegram.org/bot/... and dispatches inbound messages to handlers that execute arbitrary system commands via subprocess.run (documented in the README as a run command that executes any system command), create OS users, change sudo/RDP privileges, and upload/download arbitrary files on the host. A BotFinder routine walks /, /home, /root, /etc, /var/www, /opt, /tmp, /usr/local, and Windows drives, reading.py/.json/.conf/.cfg/.env/.ini files and regex-extracting Telegram bot tokens (pattern [0-9]+:[A-Za-z0-9_-]+) along with token/api_token/webhook context. Additional bot commands (getpasswords, getsshkeys, rdp, rdpall, findbot, getallbots) return the harvested SSH keys, saved credentials, and other operators' bot tokens back over the Telegram channel. Any host on which this package runs is fully controllable by whoever holds the bot token, and installer-side secrets are exfiltrated to that operator. Package metadata lists a placeholder author (Umar <umar@example.com>) and a non-existent GitHub slug, consistent with anonymous publication of a RAT under a data-analytics-sounding name.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010962",
            "import_time": "2026-07-28T14:20:01.586361715Z",
            "modified_time": "2026-07-28T13:42:28Z",
            "sha256": "ebce016051a9e9cb604067185042ce49c7426aa1ac01aa606e430c4d1120eec7",
            "source": "amazon-inspector",
            "versions": [
                "9.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-014791",
            "import_time": "2026-08-05T13:08:46.780490226Z",
            "modified_time": "2026-08-05T12:51:51Z",
            "sha256": "897fa80f1d8a55ff480d6c7e7a71200ac31530a9f5d928389545b597c7b45903",
            "source": "amazon-inspector",
            "versions": [
                "9.0.4"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / vtranalytic

Package

Name
vtranalytic
View open source insights on deps.dev
Purl
pkg:pypi/vtranalytic

Affected ranges

Affected versions

9.*
9.0.1
9.0.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "vtranalytic/vtranalytic.py",
            "sha256": "e02e402bd389c7fe56c476c13264633990f580253315577e06163a0876ab20a4",
            "tlsh": "67e284a2cc68380742b2d65d4946e4a2f2216343525a8c13fdbc95bc1f30767b6f6abd"
        }
    ],
    "package_integrity": [
        {
            "filename": "vtranalytic-9.0.1-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "4d6f6c662de9bc7c219ffa5f53dd39ee439571cb7a295f2addd88f08cb048164",
                "md5": "a36bb51112b583f89c99c786eedc2a67",
                "sha256": "b19a86859bc10931a8ae41e24262623e50e51eff462759145af7cef5f23c1681"
            }
        },
        {
            "filename": "vtranalytic-9.0.1.tar.gz",
            "hashes": {
                "blake2b_256": "852f9239824f5bfd71fa3912d9695fa167a9f335ca891334ef8145c35ca7392a",
                "md5": "8ed64f110e085230f7276fb7ed6d2524",
                "sha256": "edfcab06e3ce6d1ca1323b4e1fdb25188a331700725d3e60966937d088b5f838"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/vtranalytic/MAL-2026-11156.json"