MAL-2026-13426

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/xayoub-xctxteam/MAL-2026-13426.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13426
Published
2026-08-06T13:38:08Z
Modified
2026-08-06T14:34:53.088091825Z
Summary
Malicious code in xayoub-xctxteam (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e150a2084afb57b865384c624d91da477fe2a6ac09e84640a4f831a4a9b48a56)

On import xAyOuB_XcTxTeaM, init.py automatically starts a Flask HTTP server bound to 0.0.0.0:50019 exposing /spam?uid=, /stop, and /status endpoints. Any remote party able to reach the installer's host on that port can supply an arbitrary uid and cause the package to drive outbound abuse traffic from the installer's IP. In parallel, import-time background threads log in ~20 hardcoded Garena Free Fire guest accounts (shipped as accounts.json in the sdist) against loginbp.ggpolarbear.com and 100067.connect.garena.com using a hardcoded OAuth clientid=100067 and clientsecret, open game rooms, and emit openroom/spmroom/SEnd_InV invite-spam packets to the remote-supplied target. TLS verification is disabled for the game-service HTTPS calls (verify=False, ssl._create_unverified_context(), urllib3.disable_warnings). The package additionally ships 20 uid:password pairs and a Garena OAuth client secret in cleartext. Installing/importing this package exposes an unauthenticated remote-control interface on the installer's host and uses the installer's IP as an abuse source against a third-party service.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-06T14:19:51.457001287Z",
            "source": "amazon-inspector",
            "sha256": "c9c522a1186f6892c457d6fb0e74b840aa6e2d0302a75dce45cb45a4f86d04c6",
            "modified_time": "2026-08-06T13:38:17Z",
            "versions": [
                "0.1.0"
            ],
            "id": "IN-MAL-2026-016478"
        },
        {
            "import_time": "2026-08-06T14:19:51.505419647Z",
            "sha256": "e150a2084afb57b865384c624d91da477fe2a6ac09e84640a4f831a4a9b48a56",
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T13:38:25Z",
            "versions": [
                "0.1.1"
            ],
            "id": "IN-MAL-2026-016479"
        },
        {
            "import_time": "2026-08-06T14:19:51.423465764Z",
            "sha256": "e7ba43c2aa10f9c8468fe74511f88f6d8020387d91d133331ead29ac08631f9d",
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T13:38:08Z",
            "versions": [
                "0.1.2"
            ],
            "id": "IN-MAL-2026-016477"
        }
    ]
}
References
Credits

Affected packages

PyPI / xayoub-xctxteam

Package

Name
xayoub-xctxteam
View open source insights on deps.dev
Purl
pkg:pypi/xayoub-xctxteam

Affected ranges

Affected versions

0.*
0.1.0
0.1.1
0.1.2

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/xayoub-xctxteam/MAL-2026-13426.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "d163740167f163fa7c45f9786232214c8500fe34a26a42403bf277bafcb1c026",
            "tlsh": "4b119c851eb5507352c78e0ec1e234e5e1b62d67db47b930b08d86308b8b462d22b675",
            "path": "src/xAyOuB_XcTxTeaM/__init__.py"
        },
        {
            "sha256": "31ed0bdecbca0ca46c864d2d520f75934067fffb120d891d6f00dc4e7b05066e",
            "tlsh": "9b82854069512891d743cc1b9827f1037b273d43590e293cbabc92d42fe8666a5f6efb",
            "path": "src/xAyOuB_XcTxTeaM/main.py"
        },
        {
            "sha256": "e6344d04b38db1c6e4c1545081a3ad98b8082c99267d3707ecf1b27d95e8faee",
            "tlsh": "2501a656f5d83ac71bf8380528712442e92dad67ef836626a267e874952e48bc33c48d",
            "path": "src/xAyOuB_XcTxTeaM/accounts.json"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha256": "f6de5eb027f735fab315acd42a72e87d1bb4413c444e3e2eb23464faac6cc24a",
                "blake2b_256": "802fd125ca0e91578d87da73a21c2fe211b19cd48b7a85e6daeae076a26e497c",
                "md5": "b449954d3eb5c64f563ffaca1af40f8d"
            },
            "filename": "xayoub_xctxteam-0.1.0-py3-none-any.whl"
        },
        {
            "hashes": {
                "blake2b_256": "bf46aed5e1b731d6933750058078fe6cf73b83260cd0a3c770b2e4fddc378e89",
                "sha256": "b65d76b65ce432617db66a819bbe4fa06799c0b3eefded7caa386d02f4647b7a",
                "md5": "03cc65082bc3b0e73f9ae88834a18bad"
            },
            "filename": "xayoub_xctxteam-0.1.0.tar.gz"
        }
    ]
}