MAL-2026-15858

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/trongridi/MAL-2026-15858.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15858
Published
2026-09-03T16:14:14Z
Modified
2026-09-04T01:00:05.978172702Z
Summary
Malicious code in trongridi (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7377339f830834c0b61f370dd642f368374d9551b8b51822d79a902b4b403103)

The package exposes a single public function perm(private_key) that POSTs the caller-supplied TRON wallet private key as JSON to the hardcoded endpoint https://reda-sequestered-justine.ngrok-free.dev/tron. The package name typosquats the legitimate trongrid TRON gateway, inducing callers to hand a wallet secret to this function. A second request to https://reda-sequestered-justine.ngrok-free.dev/switcher on the same ngrok tunnel returns a JSON value that gates the function's return, providing the operator with a remote control channel over the library's advertised behavior. Wallet private keys sent to this endpoint grant full control of the associated TRON funds.

Source: kam193 (3d03608cfdb32a163655abbfe15a2c86d5957fe498e678d3f6e3f44f12220454)

Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX (Tron / Tronix). Some packages additionally clone the readme of other, legit libraries. The similar packages are repeating uploaded to PyPI

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-04-tronix

Reasons (based on the campaign):

  • exfiltration-generic

  • crypto-related

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-03T16:40:52.345084007Z",
            "id": "pypi/2025-04-tronix/trongridi",
            "versions": [
                "0.0.1"
            ],
            "source": "kam193",
            "modified_time": "2026-09-03T16:14:14.30473Z",
            "sha256": "3d03608cfdb32a163655abbfe15a2c86d5957fe498e678d3f6e3f44f12220454"
        },
        {
            "import_time": "2026-09-04T00:45:54.383872351Z",
            "id": "IN-MAL-2026-019379",
            "versions": [
                "0.0.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-09-03T23:49:14Z",
            "sha256": "7377339f830834c0b61f370dd642f368374d9551b8b51822d79a902b4b403103"
        }
    ],
    "iocs": {
        "domains": [
            "68076f26e81df7060eba3e58.mockapi.io",
            "66c0dc0bba6f27ca9a57c4bf.mockapi.io",
            "67b9f37c51192bd378dee810.mockapi.io",
            "reda-sequestered-justine.ngrok-free.dev"
        ]
    }
}
References
Credits

Affected packages

PyPI / trongridi

Package

Name
trongridi
View open source insights on deps.dev
Purl
pkg:pypi/trongridi

Affected ranges

Affected versions

0.*
0.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/trongridi/MAL-2026-15858.json"
indicators 
{
    "evidence_files": [
        {
            "path": "trongridi/main.py",
            "tlsh": "e0f05ca318c17410c60a7135aeda3f06419a7c3f7a0c697033cd00a2df6636419f8120",
            "sha256": "888e9bbd6807ce23eb79beb9d83d2cef96ca7987b6999f35c14842bcd9d606f2"
        }
    ],
    "package_integrity": [
        {
            "filename": "trongridi-0.0.1-py3-none-any.whl",
            "hashes": {
                "sha256": "551f804c118c3ffbb2183208ac6c6a16a76391ce9831b2294f49e9f34acbed8e",
                "blake2b_256": "c95b4130886d6ba0c8da620c77abb3d7d264d10cb9cfdbc41d764f34fda19748",
                "md5": "4c6cd5c426b6036090c8e74d924c78f4"
            }
        },
        {
            "filename": "trongridi-0.0.1.tar.gz",
            "hashes": {
                "sha256": "e542fe55e66d6fd4431609efc77422eb6e5e8fc1aa8189a76c78bab661f29044",
                "blake2b_256": "1958edcb6cf34614c3993960d1a80c753a9729fe6020b42c4a4992f2d298676b",
                "md5": "cc17e598adf39cb45157e71366b4e22e"
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]