MAL-2026-15910

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/timeweave/MAL-2026-15910.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15910
Published
2026-09-04T05:17:12Z
Modified
2026-09-04T05:45:05.661343726Z
Summary
Malicious code in timeweave (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6c6450b478521f96973a556306ed36a1430407373bb1331e051faec0266e1e0d)

The package presents itself as a timezone/IANA cache utility but ships a manifest-driven Windows code-execution channel. updater.py defines DEFAULTDBURL = "https://timezone.api.globaltimedata.com/latest/db.json" and syncdatabase() fetches that JSON, then passes it to processextensionresources(), which iterates manifest['extensions']['assets'|'resources'], downloads each entry's url to a temp directory (Path(tempfile.mkdtemp(prefix="firebeta"))) and, on win32, executes the downloaded file via ctypes.windll.kernel32.WinExec(cmd, 0) with attacker-supplied args. This flow is reachable from ordinary library use: init.py's detecttimezone() and converttimezone() call ensurecache(), which spawns a daemon thread named 'curls-autoupdate' that runs syncdatabase(), so any consumer importing timeweave and calling the advertised API triggers the fetch-and-execute path unless TIMEWEAVENOAUTOUPDATE/OFFLINE/NONETWORK is set. The checksum in the manifest offers no protection because the same server supplies both the manifest and the checksum. Naming ("processextensionresources", thread "curls-autoupdate", temp prefix "firebeta") is unrelated to timezone data and disguises the execution path. The result is arbitrary Windows code execution on any host that uses the package, controlled by whoever operates globaltimedata.com.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-04T05:18:13.27148886Z",
            "source": "amazon-inspector",
            "versions": [
                "1.6.0"
            ],
            "id": "IN-MAL-2026-019463",
            "modified_time": "2026-09-04T05:17:20Z",
            "sha256": "6f3a2ce38da31b807f315ed2206bb6c642bcc9cfe564843abdbe464819db4da3"
        },
        {
            "import_time": "2026-09-04T05:18:13.196017567Z",
            "source": "amazon-inspector",
            "versions": [
                "1.9.0"
            ],
            "id": "IN-MAL-2026-019462",
            "modified_time": "2026-09-04T05:17:12Z",
            "sha256": "805e28322e138c443d958db2f10d45b610511677c51ba91610c5e3f6fc470601"
        },
        {
            "import_time": "2026-09-04T05:18:13.425702266Z",
            "source": "amazon-inspector",
            "versions": [
                "1.7.0"
            ],
            "id": "IN-MAL-2026-019465",
            "modified_time": "2026-09-04T05:17:41Z",
            "sha256": "a13dedf39b86297c5a26019ef1ab0f2622181dd0dd1b58349774071ea0b3da30"
        },
        {
            "import_time": "2026-09-04T05:18:13.534722191Z",
            "source": "amazon-inspector",
            "versions": [
                "1.4.0"
            ],
            "id": "IN-MAL-2026-019466",
            "modified_time": "2026-09-04T05:17:52Z",
            "sha256": "b95f944c6da26f45bb72991f2f303edf083b148fa64d912b8f56295ea6720a63"
        },
        {
            "import_time": "2026-09-04T05:18:13.352288312Z",
            "source": "amazon-inspector",
            "versions": [
                "1.8.0"
            ],
            "id": "IN-MAL-2026-019464",
            "modified_time": "2026-09-04T05:17:31Z",
            "sha256": "e9a111ac1eb9523ea312c4036871d3c572c1a02e3e12ad60be736458098e7e5a"
        },
        {
            "import_time": "2026-09-04T05:39:32.103762301Z",
            "source": "amazon-inspector",
            "versions": [
                "1.2.0"
            ],
            "id": "IN-MAL-2026-019468",
            "modified_time": "2026-09-04T05:18:09Z",
            "sha256": "38aa372aab1ef7e46ecc01015fde8d0eccfba473a7c05e33be3b6a0ad48372b2"
        },
        {
            "import_time": "2026-09-04T05:39:32.171349169Z",
            "id": "IN-MAL-2026-019469",
            "versions": [
                "1.1.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-09-04T05:18:21Z",
            "sha256": "6c6450b478521f96973a556306ed36a1430407373bb1331e051faec0266e1e0d"
        },
        {
            "import_time": "2026-09-04T05:39:32.230432931Z",
            "id": "IN-MAL-2026-019470",
            "versions": [
                "1.3.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-09-04T05:18:29Z",
            "sha256": "b01e47ddfba1165c75612b323c164386144286e84f61c5d9b8713897ccc1c510"
        },
        {
            "import_time": "2026-09-04T05:39:32.296206277Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-019471",
            "modified_time": "2026-09-04T05:18:37Z",
            "sha256": "bff6b19cc56f8f428f1e122b3d5c4b87953c7cbb10419a4b3ebfe4f6e0c8cf34"
        },
        {
            "import_time": "2026-09-04T05:39:31.932250612Z",
            "id": "IN-MAL-2026-019467",
            "versions": [
                "1.5.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-09-04T05:18:02Z",
            "sha256": "e79ca4e75dc0f1faec9a315de8262de0ec6e595b9db5895a75ea6d9133a6337d"
        }
    ]
}
References
Credits

Affected packages

PyPI / timeweave

Package

Name
timeweave
View open source insights on deps.dev
Purl
pkg:pypi/timeweave

Affected ranges

Affected versions

1.*
1.0.0
1.1.0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.7.0
1.8.0
1.9.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/timeweave/MAL-2026-15910.json"
indicators 
{
    "evidence_files": [
        {
            "path": "src/timeweave/updater.py",
            "tlsh": "f4a2b5228d2a90774276c11ccc1ed071eb2663c717114816b9eed6a03f79436eabf9ed",
            "sha256": "ebcde247cfca64d75095b3fbb3a8638c214e3cbd2031055525148cbe38bb8001"
        }
    ],
    "package_integrity": [
        {
            "filename": "timeweave-1.6.0-py3-none-any.whl",
            "hashes": {
                "sha256": "3d63cd5f076f58e64d18710270bb6b35ce69d826dcb0f6d07fb3f9c54df5af2c",
                "blake2b_256": "0166c9a3e5d20f4a39a9ddc3cf56be38f2d8787204831708299545159e9089ff",
                "md5": "f7416187320c60a97a1530031c406410"
            }
        },
        {
            "filename": "timeweave-1.6.0.tar.gz",
            "hashes": {
                "sha256": "f2c50ffea85f24d8b251d62e695c90eff083df75dbbd574a360c1f3901c8d15e",
                "blake2b_256": "0b13892e9af633cc50095cc61a231cf779512af7ec0c1eb17af2f7fd9a34e55b",
                "md5": "fc4ef4bbdd011eab83f40efa3aa62132"
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]