MAL-2026-14308

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/libasync/MAL-2026-14308.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14308
Published
2026-08-19T22:38:13Z
Modified
2026-08-20T04:00:12.225705020Z
Summary
Malicious code in libasync (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3563869a8df47e05e731eafb6ea62b3d8c60672c038444139d0ff5f8941bebcf)

The package was found to contain malicious code or consuming dependency that contains malicious code

Source: kam193 (a46929f4ba4ca97beaf5511f0be0af36c4d1e9deff65bea3821137c2c258eb9c)

During import, the code obfuscated in native extension downloads malicious remote executable and establishes persistence via registry keys. Downloaded binary seems to be used for cryptomining.

Attacker infrastructure corresponds with the campaign 2026-07-pyqt6darktheme.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-libasync

Reasons (based on the campaign):

  • Downloads and executes a remote executable.

  • obfuscation

  • The package contains code to detect if it is running in a sandbox environment.

  • native-extension

  • persistence

  • cryptominer

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T23:10:04.468343037Z",
            "sha256": "a46929f4ba4ca97beaf5511f0be0af36c4d1e9deff65bea3821137c2c258eb9c",
            "modified_time": "2026-08-19T22:38:13.936883Z",
            "source": "kam193",
            "id": "pypi/2026-08-libasync/libasync",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "import_time": "2026-08-20T03:49:50.894573505Z",
            "sha256": "3563869a8df47e05e731eafb6ea62b3d8c60672c038444139d0ff5f8941bebcf",
            "modified_time": "2026-08-20T03:39:39Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018434",
            "versions": [
                "1.0.0"
            ]
        }
    ],
    "iocs": {
        "urls": [
            "https://florinn.dev/files/i.bin"
        ],
        "domains": [
            "florinn.dev"
        ]
    }
}
References
Credits

Affected packages

PyPI / libasync

Package

Name
libasync
View open source insights on deps.dev
Purl
pkg:pypi/libasync

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/libasync/MAL-2026-14308.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "4e6b3bea9d7586fd08f378bffd8a52cc0444de4c264923dfe71564232ce00da1",
            "path": "libasync/__init__.py",
            "tlsh": "b7c08c25878f476371b85a53028e4004471a18212f1a882ba568a03e6aba18232dce2c"
        },
        {
            "sha256": "f059a071b5fd29a34748d965aa02e9483ea9681678d7148a345712e091f98e21",
            "path": "libasync/libasync.pyd",
            "tlsh": "61444a1262564ebafcad713ad88215819b12e4a94b314bff33858055ee1f3e0cd79bdc"
        }
    ],
    "package_integrity": [
        {
            "filename": "libasync-1.0.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "798adb10dc5c7ed072f8fa6bd7da2d02789fb8ae6c0ed5755a5ff6b0610acad1",
                "sha256": "2a9842b5ae87fde0d279d9207652bf667810a78044aacba1e1904a9421171055",
                "md5": "3b42c40d2f1ed7abf1532599efe69eb0"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]