MAL-2026-2327

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/kube-health-tools/MAL-2026-2327.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-2327

Published

2026-04-01T09:47:27Z

Modified

2026-04-22T11:48:10.277747Z

Summary

Malicious code in kube-health-tools (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (4d36d5ed9b1bc15c12e89f48c1228a4f6e3aebe558a67d535655e280b25b4440)

During import, the code download and starts remote executable that later connects to a C2 server, likely establishing a reverse tunnel. After executing the remote binary, the code performs covering-tracks actions by removing the binary from disk, and - depending on version - modifying the package code. The dropper code is either a Python script, or a compiled binary with obfuscated location of the remote binary and config for it.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-03-kube-health-tools

Reasons (based on the campaign):

Downloads and executes a remote executable.
backdoor
obfuscation
covering-tracks

Database specific

{
    "iocs": {
        "domains": [
            "sync.geeker.indevs.in"
        ],
        "urls": [
            "https://github.com/gibunxi4201/kube-node-diag/releases/download/v2.0/kube-diag-linux-amd64-packed"
        ]
    },
    "malicious-packages-origins": [
        {
            "source": "kam193",
            "id": "pypi/2026-03-kube-health-tools/kube-health-tools",
            "modified_time": "2026-04-01T09:47:27.063117Z",
            "sha256": "4d36d5ed9b1bc15c12e89f48c1228a4f6e3aebe558a67d535655e280b25b4440",
            "versions": [
                "1.0.0",
                "1.0.1",
                "1.0.2",
                "1.0.3",
                "1.0.4",
                "1.0.5",
                "1.0.6",
                "1.0.8",
                "1.0.9",
                "1.0.10",
                "1.0.11",
                "1.0.12",
                "1.0.13",
                "1.0.14",
                "2.0.0"
            ],
            "import_time": "2026-04-01T10:29:58.666977887Z"
        },
        {
            "source": "kam193",
            "id": "pypi/2026-03-kube-health-tools/kube-health-tools",
            "modified_time": "2026-04-01T09:47:27.063117Z",
            "sha256": "7e538c73cef5f37655f767c9b0c0bafcc0e41875243137f5d9bc6226a49bf7d9",
            "versions": [
                "1.0.0",
                "1.0.1",
                "1.0.2",
                "1.0.3",
                "1.0.4",
                "1.0.5",
                "1.0.6",
                "1.0.8",
                "1.0.9",
                "1.0.10",
                "1.0.11",
                "1.0.12",
                "1.0.13",
                "1.0.14",
                "2.0.0"
            ],
            "import_time": "2026-04-22T11:28:51.296613154Z"
        }
    ]
}

References

Credits

- Kamil Mańkowski (kam193) - REPORTER
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / kube-health-tools

Package

Name: kube-health-tools; View open source insights on deps.dev
Purl: pkg:pypi/kube-health-tools

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.8

1.0.9

1.0.10

1.0.11

1.0.12

1.0.13

1.0.14

2.*

2.0.0

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/kube-health-tools/MAL-2026-2327.json"