MAL-2026-15828

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/env-validator-tool/MAL-2026-15828.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15828
Published
2026-09-03T00:44:13Z
Modified
2026-09-04T01:00:05Z
Summary
Malicious code in env-validator-tool (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dd6cff735ec80019a9009add49ea47ae4b34ec0c29c1e287511d765c24300964)

The package ships no source module (only egg-info metadata) despite declaring a console_script entrypoint 'env-validator=env_validator.cli:main' that references a non-existent env_validator/ directory. Its setup.py install_requires declares 'telemetry-helper' — an unpinned, generically-named PyPI dependency — with an inline author comment reading 'Legitimate dependency with payload'. Because the package itself contains no code, the sole effect of pip install env-validator-tool is resolving and installing whatever code is published under the 'telemetry-helper' name, which then executes on the installer's machine during install. The self-labeled 'payload' comment combined with the missing implementation, unpinned generic dependency name, and stub entrypoint indicates the package is a lure whose only purpose is to pull in the sibling drop package.

Source: kam193 (6154c04795237a4ea3c9a29df7ef65a739056eeb3f20a198890bab3eb416f9ff)

In this campaign, one package contains malicious code exfiltrating environment variables during import (telemetry-helper), and another one intentionally installs it as a dependency.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-telemetry-helper

Reasons (based on the campaign):

  • exfiltration-env-variables

  • The malicious code is intentionally included in a dependency of the package

Database specific 
{
    "iocs":  {
        "domains":  [
            "real-router.duckdns.org"
        ],
        "urls":  [
            "https://real-router.duckdns.org/collect"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-09-telemetry-helper/env-validator-tool",
            "import_time":  "2026-09-03T01:33:35.706128591Z",
            "modified_time":  "2026-09-03T00:44:13.153655Z",
            "sha256":  "6154c04795237a4ea3c9a29df7ef65a739056eeb3f20a198890bab3eb416f9ff",
            "source":  "kam193",
            "versions":  [
                "1.0.0",
                "1.0.1",
                "1.0.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-019399",
            "import_time":  "2026-09-04T00:45:55.837304424Z",
            "modified_time":  "2026-09-03T23:52:20Z",
            "sha256":  "97de8bb3bf3b8917ed38f0ca67d0bb6cd3528e02290491c7c7ec2ae2f97f5164",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-019393",
            "import_time":  "2026-09-04T00:45:55.39989453Z",
            "modified_time":  "2026-09-03T23:51:25Z",
            "sha256":  "dd6cff735ec80019a9009add49ea47ae4b34ec0c29c1e287511d765c24300964",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-019387",
            "import_time":  "2026-09-04T00:45:54.942960103Z",
            "modified_time":  "2026-09-03T23:50:32Z",
            "sha256":  "df47622acf3044fc38553176b77a1c39932c02f6b53a83e9e946b18622079227",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / env-validator-tool

Package

Name
env-validator-tool
View open source insights on deps.dev
Purl
pkg:pypi/env-validator-tool

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "setup.py",
            "sha256":  "1180d66b8bf3f3ea0a50609086d5e2983548aa1e643df168d1d6fc791999ce22",
            "tlsh":  "def05c614957a6201c8199bb64bbe4431ae565132f71b89571dc47002fcc2cb6bb77b1"
        },
        {
            "path":  "env_validator_tool.egg-info/SOURCES.txt",
            "sha256":  "c0d7bdb546e5496ab8e91776406c1c53b33400cf5a642ac548407de8b60399fd",
            "tlsh":  "8ed062b2883da0e22c18d7e0939f92c794db70c3be957572c0c441c0e0d8f80269b3b0"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "env_validator_tool-1.0.1-py3-none-any.whl",
            "hashes":  {
                "blake2b_256":  "9cabc8f94a8679beb3db44452e5e5b304dcedb72b3bbbb7ddf435199214ce68e",
                "md5":  "e83088a0d2d32001a9436fab3d35ac2a",
                "sha256":  "22449998f4ca371c122f9942e2617a901bd6e0a6d16994615e278e900fbfa16f"
            }
        },
        {
            "filename":  "env_validator_tool-1.0.1.tar.gz",
            "hashes":  {
                "blake2b_256":  "e38ffcccc0b5263dd9fe1c7d64aeadc06fe9a6ac1d3c5d29e334930747383138",
                "md5":  "e853923b7d8360953844db1e9dccb939",
                "sha256":  "6cb813bc311dc6de2b3414f831ac160fd3b4df513bd8b903775e6c6bb59ad0a9"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/env-validator-tool/MAL-2026-15828.json"