MAL-2026-2512

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/roboat-utils/MAL-2026-2512.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-2512

Published

2026-04-08T09:50:08Z

Modified

2026-05-28T05:01:15.224377255Z

Summary

Malicious code in roboat-utils (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (206186397510c57a9f8cb5e6ca8bdf9d5e1349b99e73f8d06da13e687924feea)

This package is a malicious clone of a legitimate Roblox API wrapper. The new versions are published simultaneously with publishing malicious dependencies and quickly removed once they are gone.

The campaign is built over a malicious Roblox API wrapper. The roboat[.]pro domain advertises a wrapper that is either directly malicious (as roboat collected in the campaign 2026-03-rowrap) or uses a malicious dependencies (like roboat-utils). New versions are published simultaneously with malicious dependencies and quickly removed. Another advertisement channel is https://github.com/Addi9000/roboat referencing two active contributors: https://github.com/Addi9000 and https://github.com/RoCruise

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-03-roboat-addition

Reasons (based on the campaign):

The package overrides the install command in setup.py to execute malicious code during installation.
Downloads and executes a remote executable.
malware
clones-real-package
The malicious code is intentionally included in a dependency of the package

Database specific

{
    "iocs": {
        "urls": [
            "https://jolly-violet-def9.staraledreamer.workers.dev/DDDD.exe",
            "https://holy-sun-41ff.staraledreamer.workers.dev/gore.vbs",
            "https://github.com/betonme27/flies/releases/download/a/s22s.zhr",
            "https://dawn-thunder-f821.staraledreamer.workers.dev/gore.vbs",
            "https://green-shadow-38d7.aledreamsaledreams2.workers.dev/tree.vbs",
            "https://spring-math-9df3.aledreamsaledreams2.workers.dev/winre.bat"
        ],
        "domains": [
            "jolly-violet-def9.staraledreamer.workers.dev",
            "holy-sun-41ff.staraledreamer.workers.dev",
            "spring-math-9df3.aledreamsaledreams2.workers.dev"
        ]
    },
    "malicious-packages-origins": [
        {
            "source": "kam193",
            "versions": [
                "1.0.0",
                "2.1.0",
                "2.2.0",
                "2.3.0",
                "2.4.0",
                "2.5.0",
                "2.6.0",
                "2.7.0",
                "2.8.0",
                "2.9.0",
                "3.0.0"
            ],
            "sha256": "c15304e0e1b34d5312c637f35c3488f85938fc670520baf4d9827984bc782893",
            "modified_time": "2026-04-08T09:50:08.282985Z",
            "id": "pypi/2026-03-roboat-addition/roboat-utils",
            "import_time": "2026-04-08T09:56:46.30624183Z"
        },
        {
            "source": "kam193",
            "versions": [
                "1.0.0",
                "2.1.0",
                "2.2.0",
                "2.3.0",
                "2.4.0",
                "2.5.0",
                "2.6.0",
                "2.7.0",
                "2.8.0",
                "2.9.0",
                "3.0.0"
            ],
            "sha256": "206186397510c57a9f8cb5e6ca8bdf9d5e1349b99e73f8d06da13e687924feea",
            "modified_time": "2026-04-08T09:50:08.282985Z",
            "id": "pypi/2026-03-roboat-addition/roboat-utils",
            "import_time": "2026-04-08T10:27:39.261440005Z"
        },
        {
            "source": "kam193",
            "versions": [
                "1.0.0",
                "2.1.0",
                "2.2.0",
                "2.3.0",
                "2.4.0",
                "2.5.0",
                "2.6.0",
                "2.7.0",
                "2.8.0",
                "2.9.0",
                "3.0.0"
            ],
            "sha256": "7ab52e38c48e9c2f34d5ce1c04b216265940886195751a83a1e0b68c09500109",
            "modified_time": "2026-04-08T09:50:08.282985Z",
            "id": "pypi/2026-03-roboat-addition/roboat-utils",
            "import_time": "2026-04-10T21:47:38.810370131Z"
        },
        {
            "source": "kam193",
            "versions": [
                "1.0.0",
                "2.1.0",
                "2.2.0",
                "2.3.0",
                "2.4.0",
                "2.5.0",
                "2.6.0",
                "2.7.0",
                "2.8.0",
                "2.9.0",
                "3.0.0"
            ],
            "sha256": "2b51c791187a1ced10072b92646132f29669248a08812c50d2b15e3763fd528f",
            "modified_time": "2026-04-08T09:50:08.282985Z",
            "id": "pypi/2026-03-roboat-addition/roboat-utils",
            "import_time": "2026-04-12T21:46:35.819023583Z"
        },
        {
            "sha256": "53ace8b13ba07bf3dd0369dc88bfe816cff02dc5f71324fd28174f5ecf6f3155",
            "import_time": "2026-04-16T07:38:25.028088276Z",
            "id": "pypi/2026-03-roboat-addition/roboat-utils",
            "modified_time": "2026-04-08T09:50:08.282985Z",
            "versions": [
                "1.0.0",
                "2.1.0",
                "2.2.0",
                "2.3.0",
                "2.4.0",
                "2.5.0",
                "2.6.0",
                "2.7.0",
                "2.8.0",
                "2.9.0",
                "3.0.0"
            ],
            "source": "kam193"
        },
        {
            "sha256": "955ceaaecd1e58585e49889ad2766ac5d7160e5b3cd14598dd4fb9e0f8817d8c",
            "import_time": "2026-04-25T08:25:00.424105199Z",
            "id": "pypi/2026-03-roboat-addition/roboat-utils",
            "modified_time": "2026-04-08T09:50:08.282985Z",
            "versions": [
                "1.0.0",
                "2.1.0",
                "2.2.0",
                "2.3.0",
                "2.4.0",
                "2.5.0",
                "2.6.0",
                "2.7.0",
                "2.8.0",
                "2.9.0",
                "3.0.0"
            ],
            "source": "kam193"
        },
        {
            "id": "pypi/2026-03-roboat-addition/roboat-utils",
            "import_time": "2026-04-26T17:18:12.857823006Z",
            "versions": [
                "1.0.0",
                "2.1.0",
                "2.2.0",
                "2.3.0",
                "2.4.0",
                "2.5.0",
                "2.6.0",
                "2.7.0",
                "2.8.0",
                "2.9.0",
                "3.0.0"
            ],
            "modified_time": "2026-04-08T09:50:08.282985Z",
            "source": "kam193",
            "sha256": "4c2a96867e6ae27a13d0d2453e4ed8fda1468fe89e37fc0136f93c1eaf305736"
        },
        {
            "id": "pypi/2026-03-roboat-addition/roboat-utils",
            "versions": [
                "1.0.0",
                "2.1.0",
                "2.2.0",
                "2.3.0",
                "2.4.0",
                "2.5.0",
                "2.6.0",
                "2.7.0",
                "2.8.0",
                "2.9.0",
                "3.0.0"
            ],
            "source": "kam193",
            "modified_time": "2026-04-08T09:50:08.282985Z",
            "sha256": "f1da7a522a23870afbe8beba34afbf4899c7fbc3a3b2d4ffd59322ecb56b5667",
            "import_time": "2026-04-27T21:50:25.251330823Z"
        },
        {
            "source": "kam193",
            "versions": [
                "1.0.0",
                "2.1.0",
                "2.2.0",
                "2.3.0",
                "2.4.0",
                "2.5.0",
                "2.6.0",
                "2.7.0",
                "2.8.0",
                "2.9.0",
                "3.0.0"
            ],
            "sha256": "e9e62b16a3bd60900422c3d226590702add088b873ae43bbd451ba7f90058537",
            "modified_time": "2026-04-08T09:50:08.282985Z",
            "import_time": "2026-04-28T22:49:44.436873358Z",
            "id": "pypi/2026-03-roboat-addition/roboat-utils"
        },
        {
            "id": "pypi/2026-03-roboat-addition/roboat-utils",
            "versions": [
                "1.0.0",
                "2.1.0",
                "2.2.0",
                "2.3.0",
                "2.4.0",
                "2.5.0",
                "2.6.0",
                "2.7.0",
                "2.8.0",
                "2.9.0",
                "3.0.0"
            ],
            "source": "kam193",
            "modified_time": "2026-04-08T09:50:08.282985Z",
            "sha256": "3f76a3127e2d08c73bc3e30b4b4356e0ba6792eaaacf026819b77e8e997dc693",
            "import_time": "2026-05-03T20:48:01.324270105Z"
        },
        {
            "source": "kam193",
            "import_time": "2026-05-28T04:57:09.805822813Z",
            "sha256": "35a5a97d865b620e89a20e70950a33435715fbfd445ba325effadfdb85cd4714",
            "modified_time": "2026-04-08T09:50:08.282985Z",
            "id": "pypi/2026-03-roboat-addition/roboat-utils",
            "versions": [
                "1.0.0",
                "2.1.0",
                "2.2.0",
                "2.3.0",
                "2.4.0",
                "2.5.0",
                "2.6.0",
                "2.7.0",
                "2.8.0",
                "2.9.0",
                "3.0.0"
            ]
        }
    ]
}

References

Credits

- Kamil Mańkowski (kam193) - ANALYST
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / roboat-utils

Package

Name: roboat-utils; View open source insights on deps.dev
Purl: pkg:pypi/roboat-utils

Affected ranges

Affected versions

1.*

1.0.0

2.*

2.1.0

2.2.0

2.3.0

2.4.0

2.5.0

2.6.0

2.7.0

2.8.0

2.9.0

3.*

3.0.0

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/roboat-utils/MAL-2026-2512.json"