MAL-2026-17188

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/sherpy/MAL-2026-17188.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17188
Published
2026-09-25T21:13:33Z
Modified
2026-09-28T18:30:05Z
Summary
Malicious code in sherpy (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (561bac708df60298c46df70c27282912b3955ec3fd83a23e251c268e814cdcbf)

The sherpy package presents itself as an OSINT command-line tool but ships all of its logic inside a 10.8 MB precompiled PyO3 native module at sherpy/_core.abi3.so. The Python surface is a trivial shim: sherpy/__init__.py is empty and sherpy/cli.py only forwards to three entry points in the native module — osi(), send_tg_ar(), and send_tg_trt(). The compiled crate manifest links teloxide (Telegram Bot API client), reqwest/hyper (HTTP), dirs (home-directory locators), walkdir (recursive filesystem enumeration), zip (archiving), and wallet-relevant cryptographic crates aes, chacha20, bs58, and pbkdf2, plus windows-sys for Windows host access. The send_tg_* naming combined with this dependency set matches a Telegram-bot exfiltration stealer: enumerate the user's home directory, collect wallet keystores and credential files, package them, and upload to an attacker-controlled Telegram bot whose token and chat ID are hardcoded inside the opaque binary. Running the advertised CLI therefore causes the installer's wallet and credential material to be exfiltrated to the author's Telegram endpoint. The behavior is hidden inside a compiled native module with no source shipped, defeating text-based source review.

Source: kam193 (2e5440f1e24545fd14e73c7fc459a9abf893f4674683899ed29ff7c4189416b6)

When used, the package exfiltrates Chrome extension files (likely targeting cryptocurrency wallets) and sensitive Telegram files.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-sherpy

Reasons (based on the campaign):

  • infostealer

  • exfiltration-crypto

  • target:telegram

  • native-extension

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-09-sherpy/sherpy",
            "import_time":  "2026-09-25T21:39:29.011040322Z",
            "modified_time":  "2026-09-25T21:13:33.099872Z",
            "sha256":  "2e5440f1e24545fd14e73c7fc459a9abf893f4674683899ed29ff7c4189416b6",
            "source":  "kam193",
            "versions":  [
                "0.1.0",
                "0.1.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-020598",
            "import_time":  "2026-09-28T18:24:39.256856403Z",
            "modified_time":  "2026-09-28T18:06:26Z",
            "sha256":  "561bac708df60298c46df70c27282912b3955ec3fd83a23e251c268e814cdcbf",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-020602",
            "import_time":  "2026-09-28T18:24:39.647057174Z",
            "modified_time":  "2026-09-28T18:07:03Z",
            "sha256":  "ccf9ac745692bddc25946cb3bb58b90aebf56714a2f578d80a1ca9f25c195ff9",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / sherpy

Package

Name
sherpy
View open source insights on deps.dev
Purl
pkg:pypi/sherpy

Affected ranges

Affected versions

0.*
0.1.0
0.1.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "sherpy/cli.py",
            "sha256":  "34e16c15850ccae7132e1604634b8c82256cb4ea918d6a31f193b7e3b37b8beb",
            "tlsh":  "bae092201df11d26c353c4998434c2b45a97b997494b2437fcec826e2fc2132cab90af"
        },
        {
            "path":  "sherpy/_core.abi3.so",
            "sha256":  "735b9f9264b793f8856f7c8f78e71e89fd63cc5a7510b85c1ef40537a1ac4185",
            "tlsh":  "d1b69e1bba1d6c1ec2c3b0bf8cad45641067b7503114c68a3c159e2efd96bd58a3b73a"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "sherpy-0.1.1-cp39-abi3-macosx_11_0_arm64.whl",
            "hashes":  {
                "blake2b_256":  "1ddfb24e4d0efc258a640374e7fff30216f0065bcf437df234b95b28c606a069",
                "md5":  "00c30313b594f086c19371acb51fadba",
                "sha256":  "4c735256e36853258a7670841141b46de72939cac0ceb27d8bb75aa96b4c8a15"
            }
        },
        {
            "filename":  "sherpy-0.1.1-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
            "hashes":  {
                "blake2b_256":  "63ce97491debdedb294159e34ba75b80947337cac8e95a634ccb0777f9ea6343",
                "md5":  "58365cb5a67f1a2b23b8696b58810ef8",
                "sha256":  "c2985cb89205ec486026eddcfbeae076a82b584acc53a846c7c22b3ab506f12b"
            }
        },
        {
            "filename":  "sherpy-0.1.1-cp39-abi3-win_amd64.whl",
            "hashes":  {
                "blake2b_256":  "cc453806d086f02b39a90f47e00759d5388423d49cc31fc33f0c039219fd8894",
                "md5":  "65de52b98bb9bb62389eb2f7a7675385",
                "sha256":  "cb7656933965996b2b28b92af83065550dcd148487d1a79a060d2d81c9de800e"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/sherpy/MAL-2026-17188.json"