MAL-2026-16044

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/tsshare/MAL-2026-16044.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16044
Published
2026-09-04T00:00:00Z
Modified
2026-09-09T01:45:05Z
Summary
Malicious code in tsshare (PyPI)
Details

The package 'tsshaere' was identified as containing malicious obfuscated code in client.py

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (27b53b00771492d758231bd358fe62b1c212a76c2628633e9b3e2c308285779f)

Package presents itself as a drop-in replacement for the Tushare pro_api SDK. Its TsshareClient.query method, together with a getattr proxy that captures every attribute access, POSTs the caller-supplied auth_code (the user's tushare.pro credential in the Tushare ecosystem) together with query parameters to a hardcoded default endpoint constructed as base_url + /api/v1/proxy. The default base_url is stored as a base64 byte literal (_E = b"aHR0cHM6Ly9mc3p6dzU2LmNvbQ==") and decoded at call time by _default_base_url, resolving to https://fszzw56.com, a host unrelated to Tushare. On first call the client also collects a stable hardware fingerprint — Windows CPU ProcessorId and disk SerialNumber via PowerShell/CIM, macOS Hardware UUID via system_profiler, or Linux /etc/machine-id — SHA-256-hashes it, caches it in ~/.tsshare/device_id.json, and attaches it as meta.device_id on every request. The combination of Tushare-lookalike naming, an obfuscated non-Tushare destination, forwarding of the caller's third-party credential, and stable hardware identifiers routes both the user's Tushare token and machine identity to an author-controlled host the caller never opted into.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019735",
            "import_time": "2026-09-09T01:28:58.636872863Z",
            "modified_time": "2026-09-09T01:20:42Z",
            "sha256": "27b53b00771492d758231bd358fe62b1c212a76c2628633e9b3e2c308285779f",
            "source": "amazon-inspector",
            "versions": [
                "1.0.19"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / tsshare

Package

Name
tsshare
View open source insights on deps.dev
Purl
pkg:pypi/tsshare

Affected ranges

Affected versions

1.*
1.0.19

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "tsshare/client.py",
            "sha256": "9323e40c5a183d269df723f5f0a018a3cc7c45c9267f514871dd4c583774e204",
            "tlsh": "c24276116a211c27e793c26c9ceae501a7677c03be0829707c8c675c2f9a531f1f9ead"
        }
    ],
    "package_integrity": [
        {
            "filename": "tsshare-1.0.19-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "64b2ec98463bfb0e98e01e770a22122991df9c7cde7d3dd9f5758740811cc903",
                "md5": "fefa102513e190d47cd6e628e1290b74",
                "sha256": "8dd15f3fffd046ba286289a6b873587aa6dd6511a5833941e3c2595f57d3d362"
            }
        },
        {
            "filename": "tsshare-1.0.19.tar.gz",
            "hashes": {
                "blake2b_256": "16e50a17ab5bb8d136648007ab470bea0ea3ef91e7fe64fd1503bdda5cb1b54b",
                "md5": "9fa90663045b13aedc659fa4225c9e8b",
                "sha256": "4971759a098b6028da02b53261f8005ce4159f4695418374e20be0c9e8672333"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/tsshare/MAL-2026-16044.json"