MAL-2026-14306

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/rc4-secure/MAL-2026-14306.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14306
Published
2026-08-19T20:31:43Z
Modified
2026-08-19T23:00:51.814433015Z
Summary
Malicious code in rc4-secure (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b7bcd1dcd28ea36c95e97448601f2414f34d53eabfc5452ec2471a316ebed97b)

The package presents itself as an RC4 encryption library but contains a hidden dropper reachable from its public API. RC4Cipher.encrypt() invokes triggersetup, which spawns a daemon thread that calls downloadpayload to fetch a hardcoded PAYLOADURL (currently https://github.com/ip7z/7zip/releases/download/26.02/7z2602-x64.exe with a fallback to https://www.7-zip.org/a/7z2602-x64.exe) into a tempfile.NamedTemporaryFile(suffix='.exe'), then executepayload launches the binary detached via subprocess.Popen with DETACHEDPROCESS. Errors are silently swallowed. The behavior is undocumented in the README and unrelated to RC4. Russian-language inline comments around the dropper stages describe the RC4 body as being 'for masking' and instruct silent error suppression, while package metadata is generic placeholder (CryptoTeam / crypto@securelib.org / a nonexistent cryptoteam GitHub org). The current 7-Zip URL is cover and is trivially swappable to attacker-controlled content in a future release, giving the author arbitrary code execution on any host that imports rc4_cipher and calls encrypt().

Source: kam193 (c00d4194b32151e318678fb20166e9023d74acbed43e4a9d82f7834569cb73bd)

Package silently installs a remote executable in a way that is intentionally hidden from the user. During analysis, the code was downloading a legitimate software unrelated to provided functionality, suggesting it is a research-like demonstration.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-rc4-secure

Reasons (based on the campaign):

  • Downloads and executes a remote executable.

  • modify-system-without-consent

  • action-hidden-in-lib-usage

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T21:11:10.69035424Z",
            "sha256": "c00d4194b32151e318678fb20166e9023d74acbed43e4a9d82f7834569cb73bd",
            "modified_time": "2026-08-19T20:31:43.055814Z",
            "source": "kam193",
            "id": "pypi/2026-08-rc4-secure/rc4-secure",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "import_time": "2026-08-19T22:42:50.843064761Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-19T22:21:31Z",
            "sha256": "b7bcd1dcd28ea36c95e97448601f2414f34d53eabfc5452ec2471a316ebed97b",
            "id": "IN-MAL-2026-018428",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / rc4-secure

Package

Name
rc4-secure
View open source insights on deps.dev
Purl
pkg:pypi/rc4-secure

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/rc4-secure/MAL-2026-14306.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "11b9ae2076048aba1a09a8e2e27031df5d0c199684717b250f68d1bdb7296ac2",
            "path": "src/rc4_cipher/core.py",
            "tlsh": "cce19313ec627c884b529437c925d9027a57b43f57068b387cbc98282f96634caf9bdd"
        }
    ],
    "package_integrity": [
        {
            "filename": "rc4_secure-1.0.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "eee0368db7c5301ace8ee05dcd66e053a324e0847d41fdeee22cd7a0221fda89",
                "sha256": "8c6996cdbe7d396aae3b0b817aab708f5c13b9ea5837034210c5afe2df7ad541",
                "md5": "fe74bae050ce866d69ec996e7f0b3675"
            }
        },
        {
            "filename": "rc4_secure-1.0.0.tar.gz",
            "hashes": {
                "blake2b_256": "5af2266132c0e1f4042d3857d0731fa2d272e4a8e8162cdb861bc05d0d776e76",
                "sha256": "1ae8210f94cba6c45d396788bf2aac902be2a73767e152baf18a51eb9bd0697d",
                "md5": "09669b75a9d410aa334b0c81ff13e4b7"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]