MAL-2026-13683

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/kotoraka/MAL-2026-13683.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13683
Published
2026-08-10T05:17:20Z
Modified
2026-08-10T12:04:59.660398971Z
Summary
Malicious code in kotoraka (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e0b7d2fa2d2e401d5ca6c2cc4bb07964a955afa5e532e3947fdcfd6395570dd6)

On import, kotoraka decodes base64-obfuscated filesystem paths pointing at the user's Monero wallet directory (Windows: C:\Users<user>\Documents\Monero; Linux: /home/<user>/Monero), terminates any running feather or monero processes to release file locks, archives the wallet directory into a zip, and uploads it to the Telegram Bot API (api.telegram.org sendDocument) using a hardcoded bot token and chat_id (-5357046713). The Telegram bot token and target paths are stored as base64 literals decoded at runtime. The declared purpose of the package (an HTTP speed-up library) is unrelated to the actual behavior. The exfiltration fires as a top-level side effect of import kotoraka, with no user interaction.

Source: kam193 (e9ba78f7ee9a259fc6e518295fe3d0217c83808bbdf0fff2107883cb3cf50b3c)

During import, the package exfiltrates cryptocurrency wallet files.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-kotanku

Reasons (based on the campaign):

  • exfiltration-crypto

  • uses-telegram-bot

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.1.0"
            ],
            "import_time": "2026-08-10T06:38:36.542628501Z",
            "sha256": "e9ba78f7ee9a259fc6e518295fe3d0217c83808bbdf0fff2107883cb3cf50b3c",
            "modified_time": "2026-08-10T05:17:20.394363Z",
            "id": "pypi/2026-08-kotanku/kotoraka",
            "source": "kam193"
        },
        {
            "id": "IN-MAL-2026-017211",
            "import_time": "2026-08-10T11:51:55.247385759Z",
            "sha256": "e0b7d2fa2d2e401d5ca6c2cc4bb07964a955afa5e532e3947fdcfd6395570dd6",
            "modified_time": "2026-08-10T11:51:00Z",
            "versions": [
                "0.1.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

PyPI / kotoraka

Package

Name
kotoraka
View open source insights on deps.dev
Purl
pkg:pypi/kotoraka

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "md5": "3a4176cfc7ad5c8917cfed004387fc8b",
                "sha256": "42028ae09c4bf38af27cf1766fe8a99763e9c28b3afdf076bde88c36281ddad4",
                "blake2b_256": "3c311eb7204d39c253bb80f9968b26acdc679f9010ff45d28018ebe7d22464ba"
            },
            "filename": "kotoraka-0.1.0-py3-none-any.whl"
        },
        {
            "hashes": {
                "sha256": "6c80cc17d4b02f39880cb931f3b88c2e773de06e58544c5efbafe0189cf0988a",
                "md5": "49ca11c3ff4c6a48c862d3659844203d",
                "blake2b_256": "729390f522dd4f414fb34bd49e034394c54d8b7636744a2205f019e684be4ac5"
            },
            "filename": "kotoraka-0.1.0.tar.gz"
        }
    ],
    "evidence_files": [
        {
            "path": "kotoraka/__init__.py",
            "sha256": "cc1a48d082ca55aaffffb8701f02fa9cb428231a6fc0a6384a3ed649f4006c7b",
            "tlsh": "a151234ede6a440451b1938e2dc1d4f2c705336b6e10952f7ebc4a80afb08a6d272b7f"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/kotoraka/MAL-2026-13683.json"