MAL-2026-18759

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/chromacli/MAL-2026-18759.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18759
Published
2026-11-08T09:38:34Z
Modified
2026-11-08T10:15:04Z
Summary
Malicious code in chromacli (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (faa55f651aa1c9e23d9cbff405b6ca52086c950c76e05e04b8dd49f74dd19959)

The package presents itself as a terminal color library, but its exported API (Color.paint / print / call) contains an import-reachable Windows code path that downloads an unsigned executable from the anonymous file-sharing host gofile.io (https://store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe), writes it to %TEMP%\SolaceRuntime\solace.exe, and launches it detached via subprocess.Popen with DETACHED_PROCESS. Immediately before the drop, the code invokes PowerShell with -NoProfile -ExecutionPolicy Bypass and CREATE_NO_WINDOW to call Add-MpPreference -ExclusionPath for the SolaceRuntime folder and -ExclusionProcess for solace.exe, suppressing Microsoft Defender detection of the staged binary. The behavior is gated by os.name == 'nt' and has no connection to the package's stated color-printing purpose. The payload is unsigned, unverified, hosted on an anonymous share, and the Defender-exclusion-before-execute pattern is characteristic of Windows malware droppers.

Source: kam193 (bda96ece61753bb78748a2c20ac00ec7bfec0de9f6c67dded724f1046fd2c17d)

Package hides a code downloading and installing an infostealer.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-chromacli

Reasons (based on the campaign):

  • Downloads and executes a remote executable.

  • malware

  • infostealer

  • action-hidden-in-lib-usage

Database specific 
{
    "iocs": {
        "urls": [
            "https://cdn.discordapp.com/attachments/1560347732839891076/1562446203021566032/bedwars.exe?ex=6af1172b&is=6aefc5ab&hm=544b5aacd95a3a0cba1db54a7e7adba093e4b68b8e37c9ec7af805e8fc5e960b&",
            "https://store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022563",
            "import_time": "2026-11-08T10:11:08.746410777Z",
            "modified_time": "2026-11-08T09:39:11Z",
            "sha256": "649fbd930cef7b2a2d18cede8f17c01c9ea284d193d4000208395fecd01a7a38",
            "source": "amazon-inspector",
            "versions": [
                "0.1.2"
            ]
        },
        {
            "id": "IN-MAL-2026-022561",
            "import_time": "2026-11-08T10:11:08.558245127Z",
            "modified_time": "2026-11-08T09:38:58Z",
            "sha256": "faa55f651aa1c9e23d9cbff405b6ca52086c950c76e05e04b8dd49f74dd19959",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "pypi/2026-11-chromacli/chromacli",
            "import_time": "2026-11-08T10:11:12.714403322Z",
            "modified_time": "2026-11-08T09:52:34.695685Z",
            "sha256": "bda96ece61753bb78748a2c20ac00ec7bfec0de9f6c67dded724f1046fd2c17d",
            "source": "kam193",
            "versions": [
                "0.1.0",
                "0.1.1",
                "0.1.2",
                "0.1.3",
                "0.1.4"
            ]
        },
        {
            "id": "IN-MAL-2026-022560",
            "import_time": "2026-11-08T10:11:08.475424472Z",
            "modified_time": "2026-11-08T09:38:49Z",
            "sha256": "72936049f7fbdfd5d353f183971aae09e9d83bb9520b2cf330379314bebded89",
            "source": "amazon-inspector",
            "versions": [
                "0.1.1"
            ]
        },
        {
            "id": "IN-MAL-2026-022559",
            "import_time": "2026-11-08T10:11:08.386614907Z",
            "modified_time": "2026-11-08T09:38:42Z",
            "sha256": "d3adaa2c55288f2e59f05016afa470141220c8dd727382662844841620bef003",
            "source": "amazon-inspector",
            "versions": [
                "0.1.3"
            ]
        },
        {
            "id": "IN-MAL-2026-022558",
            "import_time": "2026-11-08T10:11:08.26315913Z",
            "modified_time": "2026-11-08T09:38:34Z",
            "sha256": "f8413360c72813148ac0903f044810f71b7747b1da6990714faa8bec876f3135",
            "source": "amazon-inspector",
            "versions": [
                "0.1.4"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / chromacli

Package

Name
chromacli
View open source insights on deps.dev
Purl
pkg:pypi/chromacli

Affected ranges

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "artifacts": [
                "chromacli-0.1.2-py3-none-any.whl"
            ],
            "path": "chromacli/core.py",
            "sha256": "3e8c691c28ea714b2b64f03682e538757c0a2853866dddf02e4e17cb56d397e1",
            "tlsh": "91715202d8495062e383c9b494a289632baebc0359ab18347d9cc3b87f4e139c1f89dd"
        }
    ],
    "package_integrity": [
        {
            "filename": "chromacli-0.1.2-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "e770192dbd53e0cdbfe103da3b993659deaa7db1479fd7bc78c9374cd10b7bbc",
                "md5": "ef5a7309587979a016c9bf33e28dca5a",
                "sha256": "0619e194f7b3b6c5e1163f84f93c713437d251fc75b6b8d5853d10ddfa84c612"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/chromacli/MAL-2026-18759.json"