MAL-2026-16131

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/aitextutils-py/MAL-2026-16131.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16131
Published
2026-09-11T15:24:15Z
Modified
2026-09-23T05:30:07Z
Summary
Malicious code in aitextutils-py (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d70c1bd80ce0363cc25271a25e742ebe8c4346c872456f78b1ac039ef4641a67)

The package was found to contain malicious code or consuming dependency that contains malicious code

Source: kam193 (59b5d893cd227654dae3bd7964e54ba20c99963660993e4239f34bba0d50b772)

This package executes code from malicious dependency, which hides code downloading script, which then downloads and executes a heavily obfuscated final stage. The remote stages are hosted on a domain presenting a suspicious-looking corporate website. The downloaded code establishes persistence e.g. as "anymeetly-cameradriver" systemd service.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-aitextkit-py

Reasons (based on the campaign):

  • obfuscation

  • Downloads and executes a remote malicious script.

  • persistence

  • infostealer

  • exfiltration-browser-data

  • rat

  • The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

Database specific 
{
    "iocs":  {
        "domains":  [
            "ssbeatech.com",
            "anymeetly.com"
        ],
        "urls":  [
            "https://ssbeatech.com/download/linux/install",
            "https://ssbeatech.com/download/linux.zip",
            "https://ssbeatech.com/download/win/install.ps1",
            "https://ssbeatech.com/download/v1.0.3/win.zip"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-09-aitextkit-py/aitextutils-py",
            "import_time":  "2026-09-11T16:19:45.182413356Z",
            "modified_time":  "2026-09-11T15:24:15.064107Z",
            "sha256":  "079adf053b093075a5d8151dbbb82bb85a45f577ae3a9f6e6c751a4779d52f77",
            "source":  "kam193",
            "versions":  [
                "0.1.0",
                "0.1.1"
            ]
        },
        {
            "id":  "pypi/2026-09-aitextkit-py/aitextutils-py",
            "import_time":  "2026-09-11T20:17:44.720377963Z",
            "modified_time":  "2026-09-11T15:24:15.064107Z",
            "sha256":  "59b5d893cd227654dae3bd7964e54ba20c99963660993e4239f34bba0d50b772",
            "source":  "kam193",
            "versions":  [
                "0.1.0",
                "0.1.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-020462",
            "import_time":  "2026-09-23T05:18:36.19813674Z",
            "modified_time":  "2026-09-23T05:10:42Z",
            "sha256":  "d70c1bd80ce0363cc25271a25e742ebe8c4346c872456f78b1ac039ef4641a67",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-020460",
            "import_time":  "2026-09-23T05:18:36.002250105Z",
            "modified_time":  "2026-09-23T05:10:25Z",
            "sha256":  "ff04f03a6bce7a49fff5faa5ac16230c1c1a31d847edadd0cc449237cf068365",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / aitextutils-py

Package

Name
aitextutils-py
View open source insights on deps.dev
Purl
pkg:pypi/aitextutils-py

Affected ranges

Affected versions

0.*
0.1.0
0.1.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "src/aitextutils/text.py",
            "sha256":  "d77fd359aff2ddaf5df761941d6b01fa1e6578394b22a1c4cecb8a3c169cf894",
            "tlsh":  "60d13110fc6b6e49c572c41fac13a806f75813978811e99738fcc5a92ff94a686f4a9c"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "aitextutils_py-0.1.1-py3-none-any.whl",
            "hashes":  {
                "blake2b_256":  "3ec206f55be36829a7642559c40b119296970215227376b21e6e2224286c70c2",
                "md5":  "afe37399caebf9abb5f6b01b4e6b01d2",
                "sha256":  "dc0ea02e0af2ce35239927cfe97806f1b5a431c0baee225ede24f1c77553230b"
            }
        },
        {
            "filename":  "aitextutils_py-0.1.1.tar.gz",
            "hashes":  {
                "blake2b_256":  "589703ccd73d026b2fdcbdecb1e3ae91901bc59a779d4ab38935eafba59143f6",
                "md5":  "ef49d5f0ba46ffddbbb250a96d07119d",
                "sha256":  "72f025ae07e58af0c39559d2003bf8c85bc3b3ec0d66305de7e0e43eb772b913"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/aitextutils-py/MAL-2026-16131.json"