MAL-2026-14389

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/envprovision/MAL-2026-14389.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14389
Published
2026-08-23T21:37:06Z
Modified
2026-09-01T22:30:04Z
Summary
Malicious code in envprovision (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a414ad5404fdeeb23c37f1580aeee8175765ba8613e8fadd1a0254bf0e25d2f6)

envprovision 1.4.0 presents itself as an environment-diagnostics helper but its public check()/sync() API, on Windows, fetches a JSON manifest from a base64-obfuscated URL that decodes to https://env-metadata.up.railway.app/vbv_a8F3kL92xQ/manifest.json, downloads the referenced binary to a temp path, and executes it. TLS verification is disabled on both the manifest fetch and the binary download (ctx.check_hostname=False, ctx.verify_mode=ssl.CERT_NONE), so the payload can also be substituted by any on-path attacker. The dropped binary is invoked with NSIS silent-install flags (/S, /NCRC) built by character-list concatenation and hidden-window creation flags, then a follow-on syshelpear.exe is spawned detached (CREATE_NO_WINDOW|DETACHED_PROCESS) from a user-writable ProgramFiles/LOCALAPPDATA location as a persistence helper. After execution, wevtutil cl Application and wevtutil cl System are invoked to erase Windows event logs. The endpoint obfuscation, TLS-off fetch-and-execute of an opaque binary from a publisher-mismatched Railway subdomain, silent-install flag assembly, detached helper launch, and anti-forensic log clearing are inconsistent with the advertised diagnostics purpose and constitute an installer-side binary dropper with persistence.

Source: kam193 (cf3a48b407852ec03ead22bb8c16c03f252ba5fafa5c86ed1a739427e7d7d869)

Exported functions hide the malicious functionality. On Windows, it downloads and installs a malicious executable, and disguises it as a system utility. After installation, the code attempts to cover its tracks by cleaning logs and removing downloaded files. The installed executable is a heavily obfuscated malware with multiple sandbox evasion techniques, finally running an infostealer identifying itself as "Snow Stealer". It collects at least browser data and modifies cryptowallet applications.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-envprovision

Reasons (based on the campaign):

  • Downloads and executes a remote executable.

  • action-hidden-in-lib-usage

  • covering-tracks

  • persistence

  • The package contains code to detect if it is running in a sandbox environment.

  • obfuscation

  • malware

  • infostealer

  • exfiltration-browser-data

  • exfiltration-crypto

Database specific 
{
    "iocs": {
        "domains": [
            "env-metadata.up.railway.app"
        ],
        "urls": [
            "https://env-metadata.up.railway.app/vbv_a8F3kL92xQ/manifest.json",
            "https://env-metadata.up.railway.app/vbv_a8F3kL92xQ/appsetupw.exe",
            "https://energy-total.up.railway.app/vbv_a8F3kL92xQ/manifest.json"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-08-envprovision/envprovision",
            "import_time": "2026-08-23T22:08:02.977700609Z",
            "modified_time": "2026-08-23T21:37:06.612848Z",
            "sha256": "cf3a48b407852ec03ead22bb8c16c03f252ba5fafa5c86ed1a739427e7d7d869",
            "source": "kam193",
            "versions": [
                "1.2.0",
                "1.3.0",
                "1.4.0"
            ]
        },
        {
            "id": "pypi/2026-08-envprovision/envprovision",
            "import_time": "2026-08-23T22:41:37.85527192Z",
            "modified_time": "2026-08-23T21:37:06.612848Z",
            "sha256": "edb91aef88dce4beff995d02c493ec56945d755830711763e10f04a26fafe8d8",
            "source": "kam193",
            "versions": [
                "1.2.0",
                "1.3.0",
                "1.4.0"
            ]
        },
        {
            "id": "IN-MAL-2026-018591",
            "import_time": "2026-08-24T05:20:12.680957751Z",
            "modified_time": "2026-08-24T05:04:46Z",
            "sha256": "a414ad5404fdeeb23c37f1580aeee8175765ba8613e8fadd1a0254bf0e25d2f6",
            "source": "amazon-inspector",
            "versions": [
                "1.4.0"
            ]
        },
        {
            "id": "IN-MAL-2026-018594",
            "import_time": "2026-08-24T05:20:12.96269736Z",
            "modified_time": "2026-08-24T05:05:16Z",
            "sha256": "0353d445914769dd5c09ff12d638e2a4f0ea2169e0efc9db8f976df9eaaced26",
            "source": "amazon-inspector",
            "versions": [
                "1.3.0"
            ]
        },
        {
            "id": "IN-MAL-2026-018592",
            "import_time": "2026-08-24T05:20:12.776710104Z",
            "modified_time": "2026-08-24T05:04:57Z",
            "sha256": "41fb2384e13c6e4f45c607f3ba94e75896fc6c011e128f09fdbd5565edbcfc42",
            "source": "amazon-inspector",
            "versions": [
                "1.2.0"
            ]
        },
        {
            "id": "pypi/2026-08-envprovision/envprovision",
            "import_time": "2026-09-01T22:15:54.37583899Z",
            "modified_time": "2026-08-23T21:37:06.612848Z",
            "sha256": "0df57803f81ac86ae955aef69c0924f7a7bbb489df8343428641dbbc84311c7e",
            "source": "kam193",
            "versions": [
                "1.2.0",
                "1.3.0",
                "1.4.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / envprovision

Package

Name
envprovision
View open source insights on deps.dev
Purl
pkg:pypi/envprovision

Affected ranges

Affected versions

1.*
1.2.0
1.3.0
1.4.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/envprovision/_core.py",
            "sha256": "3e21a40b4a2aa44563f4c21e5e689d1eba7aaa4280939ae8ba47d1020b581190",
            "tlsh": "f771557a4c4fb4034273820d5d169815d33297836fba8005b8ad4b166fb8931a5f8efe"
        },
        {
            "path": "src/envprovision/_proc.py",
            "sha256": "7ec7834451e7885805eae3e4d22c8bd8fd84b03a300a9e6828242c5c6d5da644",
            "tlsh": "53314811bc1f5101dab2c0af6821a091ebea0747d78a4877b8fdc6607f7a170c1a1d6f"
        },
        {
            "path": "src/envprovision/_net.py",
            "sha256": "4d90b9a71e8d97336c81945ff939060986e21f00f6d3238bddd8264bdb572d6c",
            "tlsh": "a821fe23dc62aa13d2b6a07d5567d5a1f32367079b569ca6f58cd2281ff4430c0a210c"
        }
    ],
    "package_integrity": [
        {
            "filename": "envprovision-1.4.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "6c777ad253b3011cb77879184b09af89f0beece77421da504611fecb1576b809",
                "md5": "c5aa87f5deaf45aa804ae06b079bda2f",
                "sha256": "c22ca485f34789be7c25c7491cc43663033847d4ce3bc3ae485794f15ca8758e"
            }
        },
        {
            "filename": "envprovision-1.4.0.tar.gz",
            "hashes": {
                "blake2b_256": "640a4f46ff7c9b0a6e7ad360fc6f382d9b947cd0c24d2e377ce28b8a4487646d",
                "md5": "a3840d1e92b1f4f8b0aaa337cbca3fd3",
                "sha256": "a9799e0c7e784c06299cb664853752ba6ba69e9ccb7c167144cd6b6717c38727"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/envprovision/MAL-2026-14389.json"