MAL-2026-17880

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/seapy-ops/MAL-2026-17880.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17880
Published
2026-10-14T08:01:32Z
Modified
2026-10-15T04:15:03Z
Summary
Malicious code in seapy-ops (PyPI)
Details

In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden prompt command also uploads the folder before sending the first prompt. File symlinks can expose content outside that directory. Server-supplied result paths additionally allow files to be written outside the working directory.

Versions 1.2.1 and 1.2.2 instead present a Python REPL that silently sends eligible single-token input to the server as an unlock password, subject to filtering and attempt limits. Other commands, excluding local help, version, unlock, configuration, and uninstall paths, can fetch Base64-encoded, gzip-compressed code, execute it in memory, and call its main function. Loader errors are disguised as Python file-not-found errors.

The malicious assessment is based on concealed file transmission in the earlier releases and interpreter impersonation, concealed input transmission, remote execution, and failure concealment in the later releases. Official distributions were verified against PyPI digests. Isolated, network-disabled tests across all eight listed versions confirmed the relevant data flows using synthetic credentials and mocked server responses, including symlink-target uploads, writes outside the working directory, REPL input transmission, and execution of a synthetic payload. No live endpoint was contacted; the actual server-supplied payload remains unknown.

Database specific 
{
    "iocs":  {
        "domains":  [
            "preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai",
            "b196q82k8891-d.space-z.ai"
        ],
        "files":  [
            {
                "digests":  {
                    "sha256":  "7e32a1e69d2f751aeac2b504df41aeb83f55afe59da2eea5a450ad602abee610"
                },
                "note":  "Version 1.0.0: hides folder collection and multipart upload behind an unlock gate and local file-peeker facade; prompt mode auto-syncs the folder. Server-supplied result paths are not confined to the working directory.",
                "paths":  [
                    "seapy/cli.py"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "faad57708526d6da246a43c4c40071c88f300bdc9a044c4644ec8b8bcd7fee18"
                },
                "note":  "Version 1.0.1: hides folder collection and multipart upload behind an unlock gate and local file-peeker facade; prompt mode auto-syncs the folder. Server-supplied result paths are not confined to the working directory.",
                "paths":  [
                    "seapy/cli.py"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "701d1b4f527cc73faa9b259167a4b39c7c825a8e282f44ce82af9d1a58bca157"
                },
                "note":  "Version 1.0.2: hides folder collection and multipart upload behind an unlock gate and local file-peeker facade; prompt mode auto-syncs the folder. Server-supplied result paths are not confined to the working directory.",
                "paths":  [
                    "seapy/cli.py"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "b76f2125109fbf98a410923554560d581e06b150316758ebb1730e7c3a5b94f2"
                },
                "note":  "Version 1.1.0: hides folder collection and multipart upload behind an unlock gate and local file-peeker facade; prompt mode auto-syncs the folder. Server-supplied result paths are not confined to the working directory.",
                "paths":  [
                    "seapy/cli.py"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "3f824ed2ec10162f03b31140a103ca837535b7555a4c3cb8d10d8af58b1bc96a"
                },
                "note":  "Version 1.1.1: hides folder collection and multipart upload behind an unlock gate and local file-peeker facade; prompt mode auto-syncs the folder. Server-supplied result paths are not confined to the working directory.",
                "paths":  [
                    "seapy/cli.py"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "a0fc3176852a8bc31f5554088efccc107d10307bd5cfd2e5987f9731a91b257e"
                },
                "note":  "Version 1.1.2: hides folder collection and multipart upload behind an unlock gate and local file-peeker facade; prompt mode auto-syncs the folder. Server-supplied result paths are not confined to the working directory.",
                "paths":  [
                    "seapy/cli.py"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "b85eeb3543399503f3219abb3ad7b4a82ed970240e536a709b7c5ffbf836bb25"
                },
                "note":  "Version 1.2.1: Python REPL silently submits eligible single-token input to the unlock endpoint; remote payload is Base64/gzip decoded and executed in memory. Loader failures are disguised as Python file-not-found errors.",
                "paths":  [
                    "seapy/cli.py"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "152b64fef9ba7163f18d6114b2bc26e317f0185f2420fc10305314aab1a2e99c"
                },
                "note":  "Version 1.2.2: Python REPL silently submits eligible single-token input to the unlock endpoint; remote payload is Base64/gzip decoded and executed in memory. Loader failures are disguised as Python file-not-found errors.",
                "paths":  [
                    "seapy/cli.py"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ]
    }
}
Credits

Affected packages

PyPI / seapy-ops

Package

Name
seapy-ops
View open source insights on deps.dev
Purl
pkg:pypi/seapy-ops

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.2.1
1.2.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/seapy-ops/MAL-2026-17880.json"