MAL-2026-17195

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/claudedashbord/MAL-2026-17195.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17195
Published
2026-09-27T08:57:31Z
Modified
2026-09-27T14:30:14Z
Summary
Malicious code in claudedashbord (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56)

The package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls telemetry.check(), which performs an HTTPS GET to a hardcoded non-publisher endpoint (https://thisisafalsepositive.st/cdn/v2/panel/manifest.json), verifies the response with an embedded key via security.unsign, and passes the decoded plaintext to exec(). This gives whoever controls that host arbitrary code execution on the installer's machine on any Python invocation after install. The execution path is gated by anti-analysis controls: _is_real() requires Documents/Downloads directories to exist under HOME/USERPROFILE, a 12-hour _GRACE maturity window is persisted in /tmp/claudedashbord-first.ts, and a 6-hour _INTERVAL throttle limits repeat calls — suppressing execution in ephemeral CI/analysis containers and delaying first fire past typical dynamic-analysis windows. The package name resembles 'Claude dashboard' and appears to be a lure. The combination of a.pth auto-executor, fetch-and-exec of remote author-controlled content, hardcoded destination, and workstation-realness/timing gates matches a dropper fingerprint.

Source: kam193 (5a1141a5d4c10d0c58128d6397750ce3fcd2ab16eea32113be3da61d7a16f5a6)

During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-donutautosellsrc

Reasons (based on the campaign):

  • infostealer

  • Downloads and executes a remote executable.

  • obfuscation

  • malware

  • native-extension

  • steganography

  • c2-in-blockchain

  • The package contains code to detect if it is running in a sandbox environment.

Database specific 
{
    "iocs":  {
        "domains":  [
            "thisisafalsepositive.st",
            "sltnnt.ru"
        ],
        "urls":  [
            "https://thisisafalsepositive.st/cdn/v2/9f4e7a2c1b8d.png",
            "https://thisisafalsepositive.st/cdn/v2/promotion/manifest.json"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-09-donutautosellsrc/claudedashbord",
            "import_time":  "2026-09-27T09:19:04.878024917Z",
            "modified_time":  "2026-09-27T08:57:31.827935Z",
            "sha256":  "5a1141a5d4c10d0c58128d6397750ce3fcd2ab16eea32113be3da61d7a16f5a6",
            "source":  "kam193",
            "versions":  [
                "0.1.0",
                "0.1.1",
                "0.1.2",
                "0.1.3"
            ]
        },
        {
            "id":  "IN-MAL-2026-020565",
            "import_time":  "2026-09-27T14:16:27.958670082Z",
            "modified_time":  "2026-09-27T13:43:35Z",
            "sha256":  "b729127d1da1d90b061129b2e7a4e37c3253d8a3b8768e05c40af1a24334f96e",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.3"
            ]
        },
        {
            "id":  "IN-MAL-2026-020566",
            "import_time":  "2026-09-27T14:16:28.069010083Z",
            "modified_time":  "2026-09-27T13:43:44Z",
            "sha256":  "2be2dc094cdafb368ffe3ca210c06fa905fc73d9d3666704300d166303bc072a",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-020572",
            "import_time":  "2026-09-27T14:16:28.686657586Z",
            "modified_time":  "2026-09-27T13:44:42Z",
            "sha256":  "6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / claudedashbord

Package

Name
claudedashbord
View open source insights on deps.dev
Purl
pkg:pypi/claudedashbord

Affected ranges

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "claudedashbord/telemetry.py",
            "sha256":  "ad0281a3dda3040d328e9e1fdb2f2b33eda18c9edc6a26bce68dc8ae56087f1a",
            "tlsh":  "2e5182f5bb8e7023c682d2588861c2e5932abd3b7e5359307dcd63645f8103592632cd"
        },
        {
            "path":  "claudedashbord/_payload.py",
            "sha256":  "4fe340696d04d6e55187c4abe683d0c61d2b15f17b45c0713983eb52d558afcc",
            "tlsh":  "77c18d7621b07332677cc56926262a3ecef25c382458ddcfcacb44e809a2e024c190ee"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "claudedashbord-0.1.3.tar.gz",
            "hashes":  {
                "blake2b_256":  "f8b2e76b7727980d1ed06d766d0293f45ae1432fd5380d3d883d7d2f3af902a3",
                "md5":  "72df32d0e09323a13aa3cc9251e902e9",
                "sha256":  "0df96d2c6ec54d2f9d45b9bad705b99108fc1d5f5de0bf1baf5c3ba9c975fe2f"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/claudedashbord/MAL-2026-17195.json"