MAL-2026-11428

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/wacve-utils/MAL-2026-11428.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11428
Published
2026-08-02T10:33:07Z
Modified
2026-08-04T22:05:26Z
Summary
Malicious code in wacve-utils (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4b2e59800b6fa0d3429fb7bccd34b4ae292dc2668919fba704a7b16ddff71071)

On import wacve_utils, the package's __init__.py unconditionally invokes check_for_updates(), which HTTP-fetches a hardcoded GitHub Gist under the user Darknet-Hacker (gist.githubusercontent.com/Darknet-Hacker/7f7e01a86e68403a457c4cd0c2d93f1d/raw/), base64-decodes the body, XORs it with a key derived from the string wacve_utils, zlib-decompresses it, marshal.loads a Python code object, and execs it in-process. If the Gist fetch fails, the module falls back to shipped opaque blobs config-linux.dat / config-termux.dat (selected by a Termux/Linux platform branch) and runs them through the same base64+XOR+zlib+marshal decode-and-exec path. No pinning, no signature verification, and the payload is mutable by the Gist owner. The package advertises itself as Lightweight utilities for chat application security checks and exposes a stub check_vulnerability that returns a random boolean — a cover story unrelated to the executed payload. Importing this package grants the Gist owner arbitrary code execution in the installer's Python process.

Source: kam193 (de96a68d25555c9ee1792a22b84307ba3bc68d1e012bd841454dc775986260cb)

The package contains encrypted code with infostealers targeting Linux and Android (execution under Termux). The encrypted code collects files, browsers data, text messages and exfiltrates them to a Telegram channel.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-wacve-utils

Reasons (based on the campaign):

  • files-exfiltration

  • exfiltration-browser-data

  • uses-telegram-bot

  • obfuscation

  • Downloads and executes a remote malicious script.

  • infostealer

Database specific 
{
    "iocs": {
        "urls": [
            "https://gist.githubusercontent.com/Darknet-Hacker/7f7e01a86e68403a457c4cd0c2d93f1d/raw/"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-08-wacve-utils/wacve-utils",
            "import_time": "2026-08-02T11:04:04.155614993Z",
            "modified_time": "2026-08-02T10:33:07.923444Z",
            "sha256": "de96a68d25555c9ee1792a22b84307ba3bc68d1e012bd841454dc775986260cb",
            "source": "kam193",
            "versions": [
                "1.0.7"
            ]
        },
        {
            "id": "pypi/2026-08-wacve-utils/wacve-utils",
            "import_time": "2026-08-02T11:52:33.616443212Z",
            "modified_time": "2026-08-02T10:33:07.923444Z",
            "sha256": "24d4ada91d3bb23e5113caff835c4f285579f06da6ebe4153a456fb2627070f7",
            "source": "kam193",
            "versions": [
                "1.0.7"
            ]
        },
        {
            "id": "IN-MAL-2026-011047",
            "import_time": "2026-08-04T21:33:15.008266033Z",
            "modified_time": "2026-08-04T21:24:49Z",
            "sha256": "4b2e59800b6fa0d3429fb7bccd34b4ae292dc2668919fba704a7b16ddff71071",
            "source": "amazon-inspector",
            "versions": [
                "1.0.7"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / wacve-utils

Package

Name
wacve-utils
View open source insights on deps.dev
Purl
pkg:pypi/wacve-utils

Affected ranges

Affected versions

1.*
1.0.7

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "wacve_utils/update_checker.py",
            "sha256": "b9729eb9dca965290e6565140aa8a303bc3cc27bf3a84cdb72719fab22de7adc",
            "tlsh": "6b514453c9ea0d22c343d954cc2792a6ab2f7e571a40a126fedc93588f0847cd0e23a9"
        },
        {
            "path": "setup.py",
            "sha256": "6433ea7b27ee59bde6eed1fdca81f54b6c81f98a45003c0e2c27891d3a49859c",
            "tlsh": "50e068d28a1996709581ad6a3aa530031978763f3ea0b4ed734401543bd91dfe7332ed"
        }
    ],
    "package_integrity": [
        {
            "filename": "wacve_utils-1.0.7-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "0dd5a6bf0379ce450a54004200b5278723e0cf0da55f5675cc0d034c003541a6",
                "md5": "2f3443bbcd0d2aba71e86f6f20a58c07",
                "sha256": "36e8fa3e7b2a0ed040a86a834dc552d9e814e02d96f859654cab53c54fcb1f47"
            }
        },
        {
            "filename": "wacve_utils-1.0.7.tar.gz",
            "hashes": {
                "blake2b_256": "c6658ffef826e9b364db8e0c4a70be674e2d685ffeb985658ab38faac5654adb",
                "md5": "8c59ea0d8f8241860c6e1a7a0bd0a972",
                "sha256": "b465fb49c2b33f4dc13364e2e5e9fcda355f2468c678a3118309a7bc8523547b"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/wacve-utils/MAL-2026-11428.json"