MAL-2026-17422

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/shortneer/MAL-2026-17422.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17422
Published
2026-10-01T21:00:49Z
Modified
2026-10-04T23:45:21Z
Summary
Malicious code in shortneer (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4960c121d2fbf6337d33df0c6a304f4f3e968d18c64614c323ac5f8389020bab)

The package ships a macOS arm64 Rust-compiled Python extension (_core.abi3.so) fronted by a thin wrapper lb.py. The only exposed Python function, shortname(), invokes two gibberish-named native entrypoints (_core.dphjx0rdhx0 and _core.ioluli0x0xthf) and swallows all exceptions with a silent print(''). The native binary embeds the hardcoded path 'Library/Application Support/Telegram Desktop/tdata' (the installer's Telegram Desktop session store on macOS), the archive name 'fghj.zip', and the destination 'https://api.telegram.org', alongside zip, AES, ChaCha20 and reqwest/rustls/hyper HTTP client code. This matches packaging the installer's live Telegram Desktop session directory and uploading it to a Telegram bot controlled by the author, which grants full takeover of the installer's Telegram account. The random-looking native export names and the blanket exception suppression serve to hide the behavior from casual inspection; the package's self-description as an OSINT utility does not match its actual data flow, which targets the installer's own messaging session store rather than any user-supplied target.

Source: kam193 (5e166ae1253c886885381cb5087f67a59a869cad6ece6f3ac40aefc6e463c27f)

When used, the package exfiltrates Chrome extension files (likely targeting cryptocurrency wallets) and sensitive Telegram files.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-sherpy

Reasons (based on the campaign):

  • infostealer

  • exfiltration-crypto

  • target:telegram

  • native-extension

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-09-sherpy/shortneer",
            "import_time":  "2026-10-01T21:42:15.070973594Z",
            "modified_time":  "2026-10-01T21:00:49.972775Z",
            "sha256":  "5e166ae1253c886885381cb5087f67a59a869cad6ece6f3ac40aefc6e463c27f",
            "source":  "kam193",
            "versions":  [
                "0.1.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-020936",
            "import_time":  "2026-10-04T23:40:43.739205311Z",
            "modified_time":  "2026-10-04T23:22:32Z",
            "sha256":  "4960c121d2fbf6337d33df0c6a304f4f3e968d18c64614c323ac5f8389020bab",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / shortneer

Package

Name
shortneer
View open source insights on deps.dev
Purl
pkg:pypi/shortneer

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "shortneer/_core.abi3.so",
            "sha256":  "7c54bf444a90dac69f2d2a833cf669a8bdee97cb534b1271d1a53d1c68d09ca4",
            "tlsh":  "6666ae0ba60d2c5fc3c7b0bf8d6944a82167b2503114d2da3c19af2eed56bd1463eb79"
        },
        {
            "path":  "shortneer/lb.py",
            "sha256":  "f0b4f691f41da2e9b203a3c6be61862c98bc208fa8d6cc489d2293e5287d242c",
            "tlsh":  "c8d012210c208d22c283e4a840b080a1a21b3e2399902a3afcdc82465fe113187fe9fe"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "shortneer-0.1.0-cp39-abi3-macosx_11_0_arm64.whl",
            "hashes":  {
                "blake2b_256":  "b3ce2533a46fcb7d8d0f757049b0760c8875836850a0900c246981032d5abe0e",
                "md5":  "7fcf98620bfb1f0b51bfb8c1c3c3263d",
                "sha256":  "38c9cdde131c1be27d5f410b6a8f37ef45a1adf7b13ed769b1176de588179178"
            }
        },
        {
            "filename":  "shortneer-0.1.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
            "hashes":  {
                "blake2b_256":  "f5ab5983f7ce85a13215286c0e31b703bd15b8405e21e7bae5459dfeea1e821f",
                "md5":  "d681c5a069d0fdb7f5b1f84c25809d78",
                "sha256":  "ba182eb5c7a15322c50b5d7d3beac9f8c213866a6a658dd898126968c4747404"
            }
        },
        {
            "filename":  "shortneer-0.1.0-cp39-abi3-win_amd64.whl",
            "hashes":  {
                "blake2b_256":  "0643fff61c5265ef83af32fdc13b7648d8dffb1600e7ef0ba6364dab18ba8cb6",
                "md5":  "ab95f517c0620490cc715770b2b8f30f",
                "sha256":  "2a67217fe8bcbf49049f3f444d28d033bcec1ce7cf680cb180a228c490869ffd"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/shortneer/MAL-2026-17422.json"