MAL-2026-17192

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/donutautosellsrc/MAL-2026-17192.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17192
Published
2026-09-27T00:09:55Z
Modified
2026-09-27T01:00:03Z
Summary
Malicious code in donutautosellsrc (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (2ac1203ac68b4bb062c4dd38f59fd8bd13fef695c5b1c8059160c6a5205717b1)

During installation package fetches code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in Polygon blockchain.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-donutautosellsrc

Reasons (based on the campaign):

  • Downloads and executes a remote executable.

  • steganography

  • malware

  • native-extension

  • infostealer

  • obfuscation

  • c2-in-blockchain

Database specific 
{
    "iocs":  {
        "domains":  [
            "thisisafalsepositive.st",
            "sltnnt.ru"
        ],
        "urls":  [
            "https://thisisafalsepositive.st/cdn/v2/9f4e7a2c1b8d.png"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-09-donutautosellsrc/donutautosellsrc",
            "import_time":  "2026-09-27T00:55:33.009378865Z",
            "modified_time":  "2026-09-27T00:15:18.839927Z",
            "sha256":  "2ac1203ac68b4bb062c4dd38f59fd8bd13fef695c5b1c8059160c6a5205717b1",
            "source":  "kam193",
            "versions":  [
                "0.3.7",
                "0.3.8",
                "0.3.9"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / donutautosellsrc

Package

Name
donutautosellsrc
View open source insights on deps.dev
Purl
pkg:pypi/donutautosellsrc

Affected ranges

Affected versions

0.*
0.3.7
0.3.8
0.3.9

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/donutautosellsrc/MAL-2026-17192.json"