MAL-2026-15936

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/trongridew/MAL-2026-15936.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15936
Published
2026-09-05T20:26:18Z
Modified
2026-09-06T14:45:03Z
Summary
Malicious code in trongridew (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (598687794d8452d6845a3529e26bf63838cedee736dc0b8545ad33abe2e827f3)

The package exposes a single public function perm(private_key) in main.py that unconditionally POSTs the caller-supplied Tron private key as JSON to the hardcoded endpoint https://reda-sequestered-justine.ngrok-free.dev/tron. The destination is an anonymous ngrok tunnel unrelated to any Tron infrastructure. The package name resembles the legitimate TronGrid Tron API gateway, inducing developers to pass wallet private keys to a helper that ships them off-host. Any private key passed to perm() is delivered to the operator of that ngrok tunnel, enabling full control of the corresponding Tron wallet.

Source: kam193 (b39b568eb2c95508c9c14eacd7c907017273e80aad0298b23a11cd0139513ec7)

Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX (Tron / Tronix). Some packages additionally clone the readme of other, legit libraries. The similar packages are repeating uploaded to PyPI

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-04-tronix

Reasons (based on the campaign):

  • exfiltration-generic

  • crypto-related

Database specific 
{
    "iocs":  {
        "domains":  [
            "68076f26e81df7060eba3e58.mockapi.io",
            "66c0dc0bba6f27ca9a57c4bf.mockapi.io",
            "67b9f37c51192bd378dee810.mockapi.io",
            "reda-sequestered-justine.ngrok-free.dev"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2025-04-tronix/trongridew",
            "import_time":  "2026-09-05T20:37:57.086810467Z",
            "modified_time":  "2026-09-05T20:26:48.366053Z",
            "sha256":  "b39b568eb2c95508c9c14eacd7c907017273e80aad0298b23a11cd0139513ec7",
            "source":  "kam193",
            "versions":  [
                "0.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-019647",
            "import_time":  "2026-09-06T14:38:05.970131137Z",
            "modified_time":  "2026-09-06T14:28:26Z",
            "sha256":  "598687794d8452d6845a3529e26bf63838cedee736dc0b8545ad33abe2e827f3",
            "source":  "amazon-inspector",
            "versions":  [
                "0.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / trongridew

Package

Name
trongridew
View open source insights on deps.dev
Purl
pkg:pypi/trongridew

Affected ranges

Affected versions

0.*
0.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "trongridew/main.py",
            "sha256":  "888e9bbd6807ce23eb79beb9d83d2cef96ca7987b6999f35c14842bcd9d606f2",
            "tlsh":  "e0f05ca318c17410c60a7135aeda3f06419a7c3f7a0c697033cd00a2df6636419f8120"
        },
        {
            "path":  "trongridew/__init__.py",
            "sha256":  "9116725fc0117f8741cc02d784b495cb969fb4828611ff3fdd5286cbed7b44b2"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "trongridew-0.0.1-py3-none-any.whl",
            "hashes":  {
                "blake2b_256":  "fc6f9175888b0cff7da655ab94a3f8f0e81166f38b5b57fe716839674d9d5fac",
                "md5":  "be41022e1be3413c8d50bc490cc3efc6",
                "sha256":  "82b48da26807b1b7e6116055e5ac1977137e8937746973cf0acc8654562b2346"
            }
        },
        {
            "filename":  "trongridew-0.0.1.tar.gz",
            "hashes":  {
                "blake2b_256":  "43d6de4e35ad5e9303c3b216a787be0179b31076b92366b1f1a93933930ede16",
                "md5":  "59e2bdbd0686d6f2a2794b3f556fe00f",
                "sha256":  "b1269bef34effd609bfdf2ff52f683f6164e8f4b2219352bb930c2fcb8a68559"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/trongridew/MAL-2026-15936.json"