MAL-2026-13666

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/cubesat-upstream-driver/MAL-2026-13666.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13666
Published
2026-08-09T13:09:20Z
Modified
2026-08-10T12:04:59.640825563Z
Summary
Malicious code in cubesat-upstream-driver (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1f5f2cf32e29ec0daedda5112ca2c560e69b4c4cd77850d6dc52d7a448e343a2)

The package is advertised as an 'Upstream driver interface for cubesat orbital command bus' but ships no driver, protocol, or telemetry code. Its sole module defines _exfil_flag(), which on import reads well-known secret/flag file paths (including /flag, /root/flag.txt, and /**/flag* globs), scans os.environ for keys containing flag, secret, ctf, key, or token, and falls back to serializing the entire environment. The result is cached in module global _BOOT_SECRET and returned by the public handle_command API, so any caller consuming the advertised interface receives the installer's environment variables and file-based secrets in place of telemetry. handle_command also re-runs the harvest on each invocation.

Source: kam193 (d669fdf7584f17d952cec3ed432bdb8f07672b43c3bc42ae68aa2d042d51481b)

Package appears to abuse PyPI for a CTF-like exercise. It can collect up to all environment variables. The package does not exfiltrate them on its own, suggesting there is another external trigger for that.

Originally detected by Aikido.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: 2026-08-cubesat-upstream-driver

Reasons (based on the campaign):

  • dependency-confusion

  • other

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-08-cubesat-upstream-driver/cubesat-upstream-driver",
            "import_time": "2026-08-09T13:50:51.214656911Z",
            "sha256": "d669fdf7584f17d952cec3ed432bdb8f07672b43c3bc42ae68aa2d042d51481b",
            "versions": [
                "1.0.1"
            ],
            "source": "kam193",
            "modified_time": "2026-08-09T13:09:20.505024Z"
        },
        {
            "id": "IN-MAL-2026-017205",
            "import_time": "2026-08-10T11:51:54.663616204Z",
            "sha256": "1f5f2cf32e29ec0daedda5112ca2c560e69b4c4cd77850d6dc52d7a448e343a2",
            "modified_time": "2026-08-10T11:49:31Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / cubesat-upstream-driver

Package

Name
cubesat-upstream-driver
View open source insights on deps.dev
Purl
pkg:pypi/cubesat-upstream-driver

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "cubesat_upstream_driver/__init__.py",
            "tlsh": "7831fec1bb693c53e0d25128953ac1052b2efd473a45207abacc53622f6c1acccb9689",
            "sha256": "9b267c1b94f311314cce2df208b59fb8030d3129376a10f52966d6f67302a789"
        },
        {
            "path": "pyproject.toml",
            "tlsh": "c3f02d1bc9d65c279581608260020a01bef0942b1bc9c00e23efc009ebae8cac2fe828",
            "sha256": "c00189e7d418e6fd090733cb85dc1b0c42ffc73edea24e08a3dbe147faf9f3ee"
        }
    ],
    "package_integrity": [
        {
            "filename": "cubesat_upstream_driver-1.0.1-py3-none-any.whl",
            "hashes": {
                "sha256": "1f90912d5cb8104ef518cd16a3de1b303f7b871a5b8a4096185595b54600e8f4",
                "blake2b_256": "3e894cfbbe93af11314f9ad2770da09844de83764b36e24957de07363edae3d5",
                "md5": "8ff8584dd9385b84c682606ced403bc3"
            }
        },
        {
            "filename": "cubesat_upstream_driver-1.0.1.tar.gz",
            "hashes": {
                "sha256": "9fc77502c2bb533baf48b3b7adbbd9c33f7c61105bf84d7145bfa817af98059c",
                "blake2b_256": "eb552d8df86746f5e01d0e939e35e8bd4f75138977ed9ec8ce3a5c6fdd7b2690",
                "md5": "9ef7881f15529d3ee8fe774d80071bfa"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/cubesat-upstream-driver/MAL-2026-13666.json"