MAL-2026-2280

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/roboat-additions/MAL-2026-2280.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-2280

Published

2026-03-28T20:16:43Z

Modified

2026-05-28T05:01:14.529051669Z

Summary

Malicious code in roboat-additions (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (1af64a27f6bd87cbd380cb838d6c8c06696f9497c246fe348d5af1bbc17f6122)

During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap.

The campaign is built over a malicious Roblox API wrapper. The roboat[.]pro (later robase[.]app) domain advertises a wrapper that is either directly malicious (as roboat collected in the campaign 2026-03-rowrap) or uses a malicious dependencies (like roboat-utils). New versions are published simultaneously with malicious dependencies and quickly removed. Another advertisement channel is https://github.com/Addi9000/roboat referencing two active contributors: https://github.com/Addi9000 and https://github.com/RoCruise

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-03-roboat-addition

Reasons (based on the campaign):

The package overrides the install command in setup.py to execute malicious code during installation.
Downloads and executes a remote executable.
The malicious code is intentionally included in a dependency of the package
malware
clones-real-package

Database specific

{
    "iocs": {
        "urls": [
            "https://jolly-violet-def9.staraledreamer.workers.dev/DDDD.exe"
        ],
        "domains": [
            "jolly-violet-def9.staraledreamer.workers.dev"
        ]
    },
    "malicious-packages-origins": [
        {
            "import_time": "2026-03-28T20:45:52.986063772Z",
            "versions": [
                "0.0.1"
            ],
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "source": "kam193",
            "sha256": "6e8249fcecd9e50d0a15f76664e1217784ee8a5d1412a159cc076eff2cf57a78"
        },
        {
            "source": "kam193",
            "versions": [
                "0.0.1"
            ],
            "sha256": "8821279183dbb447693e0a2a66d9b262fc34d063cd0b75158160a70131bce036",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "import_time": "2026-03-29T12:49:09.560259499Z"
        },
        {
            "import_time": "2026-03-29T20:46:34.588177185Z",
            "versions": [
                "0.0.1"
            ],
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "source": "kam193",
            "sha256": "558a2961bad2da46037dab165a9187c76126fafc69b51c91b8b73a3f0a16b5a2"
        },
        {
            "import_time": "2026-04-04T22:45:36.631569408Z",
            "versions": [
                "0.0.1"
            ],
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "source": "kam193",
            "sha256": "06d6a3471197c97a19d59f4e5e987000e3fed447ce9449325a8be19b86a1f889"
        },
        {
            "source": "kam193",
            "versions": [
                "0.0.1"
            ],
            "import_time": "2026-04-05T09:18:40.866508914Z",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "sha256": "650645603340ae7ece2cdd474c4358c430b96d4c3512c9b62af264b5b709200f"
        },
        {
            "import_time": "2026-04-08T10:27:39.260590199Z",
            "versions": [
                "0.0.1"
            ],
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "source": "kam193",
            "sha256": "70dd8f359a78dc1edd3a6f49bb17667a5614f46df7a7b0846704263f31e5990d"
        },
        {
            "source": "kam193",
            "versions": [
                "0.0.1"
            ],
            "sha256": "f0e7a8003b676a321abb4c3f158c0ead59fa2193e25285808f30504b340345a3",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "import_time": "2026-04-10T21:47:38.808675232Z"
        },
        {
            "source": "kam193",
            "versions": [
                "0.0.1"
            ],
            "sha256": "14a9ba638c728ba5ff58cc8220da65cb36ecf1dc507272f6a601c6b8e81cc9ab",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "import_time": "2026-04-12T21:46:35.817116514Z"
        },
        {
            "source": "kam193",
            "versions": [
                "0.0.1"
            ],
            "sha256": "1af64a27f6bd87cbd380cb838d6c8c06696f9497c246fe348d5af1bbc17f6122",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "import_time": "2026-04-12T22:12:37.194381514Z"
        },
        {
            "import_time": "2026-04-16T07:38:25.02576474Z",
            "versions": [
                "0.0.1"
            ],
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "source": "kam193",
            "sha256": "320933c38d22ef6e76ca4866c11b33cbf245976661410c5ecef5dfc47e0b5fd8"
        },
        {
            "import_time": "2026-04-25T08:25:00.421549763Z",
            "versions": [
                "0.0.1"
            ],
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "source": "kam193",
            "sha256": "6e10d2cad7d80003c55c8f9e464b6a19ea9f4be74d9d2253899441998e05cec5"
        },
        {
            "import_time": "2026-04-26T17:18:12.855341706Z",
            "versions": [
                "0.0.1"
            ],
            "source": "kam193",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "sha256": "8ac5e935bbeefa876f82d11054455a8fb01a61d283e2daa05d0e9edf14d334ad"
        },
        {
            "source": "kam193",
            "versions": [
                "0.0.1"
            ],
            "sha256": "3027d58dd2391de774d1a29617cbfe71255d4dd7f170b3ddfdfdb75ebbacda4a",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "import_time": "2026-04-27T21:50:25.248875502Z"
        },
        {
            "import_time": "2026-04-28T22:49:44.43431268Z",
            "versions": [
                "0.0.1"
            ],
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "source": "kam193",
            "sha256": "74a112dc5a0c6960c4741d1f0fe8d8fc21cd37b23c5b34e6c1d667bd598ae95d"
        },
        {
            "source": "kam193",
            "versions": [
                "0.0.1"
            ],
            "import_time": "2026-05-03T20:48:01.321668481Z",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "sha256": "3ade8b6f7ac978ccf041268469fe1ad0465d6998d40f3d10b76efa16cd1caa71"
        },
        {
            "source": "kam193",
            "versions": [
                "0.0.1"
            ],
            "import_time": "2026-05-28T04:57:09.803552963Z",
            "modified_time": "2026-03-28T20:16:43.466544Z",
            "id": "pypi/2026-03-roboat-addition/roboat-additions",
            "sha256": "6b39c1bdd3271ef116eaacf69e66fee6475770cadcdbab4c706b5ea77eb98230"
        }
    ]
}

References

Credits

- Kamil Mańkowski (kam193) - ANALYST
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / roboat-additions

Package

Name: roboat-additions; View open source insights on deps.dev
Purl: pkg:pypi/roboat-additions

Affected ranges

Affected versions

0.*

0.0.1

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/roboat-additions/MAL-2026-2280.json"