MAL-2026-14401

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/multyproccess/MAL-2026-14401.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-14401

Published

2026-08-24T08:04:14Z

Modified

2026-08-24T17:00:11.907981321Z

Summary

Malicious code in multyproccess (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7938a109a642dfe8b161e9568d6373a038c3413c0fd1f2b01702f4f173348553)

The package's setup.py overrides the install and develop cmdclass to base64-decode a bundled request/.payload file and launch it via subprocess.Popen([sys.executable, '-c', payload],...) with DETACHEDPROCESS|CREATENO_WINDOW at pip install time. The decoded payload is a Windows infostealer that enumerates Chrome/Edge/Brave/Opera/Vivaldi/Firefox profiles (cookies, logins, key4.db, autofill, saved cards), 50+ crypto wallet browser extensions and standalone wallet apps (Electrum, Binance, Ethereum), clipboard contents, email/FTP client credentials, and system fingerprint data, advertising a Chrome v20 ABE bypass. Collected data is exfiltrated to api.telegram.org/bot<TOKEN>/sendMessage and /sendDocument, and to https://recloud-blush.vercel.app; ipinfo.io is queried for geolocation. The payload also installs boot persistence disguised as svchost.exe, performs periodic screenshotting when crypto apps are active, targeted keylogging for passwords/seeds/private keys, and maintains a real-time C2 channel. The package name typosquats 'multiprocessing' while its metadata forges the publisher identity as 'Python Software Foundation' (python-dev@python.org, github.com/psf/request) and request/init.py re-exports symbols from the real requests library as a cover story.

Source: kam193 (93a751dcfb2e5ac6058cbd62220d237288d3ceb4d8fe152b7ef7babb645df660)

During installation, package executes an infostealer that e.g. exfiltrates browsers and crypto wallets data, establishes persistence, monitors clipboard.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-multyproccess

Reasons (based on the campaign):

typosquatting
infostealer
exfiltration-crypto
exfiltration-browser-data
clones-real-package
The package overrides the install command in setup.py to execute malicious code during installation.
The package contains code to detect if it is running in a sandbox environment.
obfuscation
persistence

Database specific

{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-24T08:11:17.009884Z",
            "sha256": "93a751dcfb2e5ac6058cbd62220d237288d3ceb4d8fe152b7ef7babb645df660",
            "versions": [
                "2.32.3",
                "2.32.4",
                "2.32.5",
                "2.32.6"
            ],
            "source": "kam193",
            "id": "pypi/2026-08-multyproccess/multyproccess",
            "import_time": "2026-08-24T08:21:36.69523231Z"
        },
        {
            "import_time": "2026-08-24T08:50:02.934969816Z",
            "modified_time": "2026-08-24T08:24:32.666354Z",
            "versions": [
                "2.32.3",
                "2.32.4",
                "2.32.5",
                "2.32.6"
            ],
            "source": "kam193",
            "id": "pypi/2026-08-multyproccess/multyproccess",
            "sha256": "781f839a82802af9075e777e8f2fa0f22d9a85ca1751fc1112c91248e277c21c"
        },
        {
            "modified_time": "2026-08-24T16:36:56Z",
            "sha256": "6439eb2d03b858c21ec644194acb914698449861c904a172618464515fafbedc",
            "versions": [
                "2.32.5"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018619",
            "import_time": "2026-08-24T16:49:12.740645376Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-24T16:37:04Z",
            "versions": [
                "2.32.3"
            ],
            "sha256": "6c2ce4c5e80f4ed97b8a9b8eacf614bc269fb50d0deb8326a6bd09a7b2db333b",
            "id": "IN-MAL-2026-018620",
            "import_time": "2026-08-24T16:49:12.809334667Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-24T16:36:41Z",
            "versions": [
                "2.32.6"
            ],
            "sha256": "6dac1412391b8c69b022367202cc28aa6ea605d71389245ed521be51004323cd",
            "id": "IN-MAL-2026-018617",
            "import_time": "2026-08-24T16:49:12.557464915Z"
        },
        {
            "sha256": "7938a109a642dfe8b161e9568d6373a038c3413c0fd1f2b01702f4f173348553",
            "source": "amazon-inspector",
            "versions": [
                "2.32.4"
            ],
            "modified_time": "2026-08-24T16:36:49Z",
            "id": "IN-MAL-2026-018618",
            "import_time": "2026-08-24T16:49:12.66908982Z"
        }
    ],
    "iocs": {
        "domains": [
            "recloud-blush.vercel.app"
        ]
    }
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com
- Kamil Mańkowski (kam193) - REPORTER
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / multyproccess

Package

Name: multyproccess; View open source insights on deps.dev
Purl: pkg:pypi/multyproccess

Affected ranges

Affected versions

2.*

2.32.3

2.32.4

2.32.5

2.32.6

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/multyproccess/MAL-2026-14401.json"

indicators

{
    "evidence_files": [
        {
            "path": "setup.py",
            "sha256": "63682aed81bc308ae13c74930a6b7ecd0ada0c07245bb9e2754342331d873710",
            "tlsh": "d8e13252cdc9122084b2c13f91139c67d25b33136e5704a77dfc8698afb5622c1bd6be"
        },
        {
            "path": "request/.payload",
            "sha256": "c45a32556cd98e1638bc6f4b407f7d2913669adfaac362471823d14913115817",
            "tlsh": "c0e46d229f402f4dbb8b491be4ec2ac667bf2b8ed0f371cc1b07664766aed0945d5448"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "blake2b_256": "48047d7e6f3b229c898c6532adfe8393bb083c30a27aff1dac972e1bbe70668d",
                "sha256": "4191a5f402c784908692efe1ecf60f2ba965849df5cc82abd5d8ed28f4bca486",
                "md5": "ac192a1af76b1bf61f3af710ecde05f4"
            },
            "filename": "multyproccess-2.32.5-py3-none-any.whl"
        },
        {
            "hashes": {
                "blake2b_256": "2748d8c21f99197237af76d9f26521ba0f5b3894373f59935e8f45d466b471bc",
                "sha256": "e88143d60fd41d9b8246daa38c8a6eb1c9e284200e741ad2e5d3fcc2866bbd35",
                "md5": "c465b92568dbf6c838c416d4e85baeff"
            },
            "filename": "multyproccess-2.32.5.tar.gz"
        }
    ]
}