MAL-2026-3133

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/fetchapi-syncdata-pypi/MAL-2026-3133.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-3133

Published

2026-04-28T18:46:19Z

Modified

2026-04-28T20:30:55.858380Z

Summary

Malicious code in fetchapi-syncdata-pypi (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (d0dcf5bd5c71d077b3763c74d57d68d5517a2b5c5229fdd5bd6f7369cb2a0f49)

The package contains code to download and start a malicious executable. It's masqueraded using name similar to Windows services. In analyzed versions, the code was not automatically started, suggesting it's just a part of a campaign. Based on the dynamic analysis, the executable is likely an infostealer.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-04-fetch-data-api-syncapi

Reasons (based on the campaign):

Downloads and executes a remote executable.
malware

Database specific

{
    "iocs": {
        "domains": [
            "botconfig4.nurmohammadrafi9966.workers.dev",
            "webhook-relay.nurmohammadrafi9966.workers.dev"
        ],
        "urls": [
            "https://www.dropbox.com/scl/fi/g9n5elasjy54dl2kwfntg/MonitorClient.exe?rlkey=wync0ieqrytdi12bugsw6hzu7&st=tf3r09pi&dl=1"
        ]
    },
    "malicious-packages-origins": [
        {
            "source": "kam193",
            "modified_time": "2026-04-28T18:46:19.734363Z",
            "sha256": "d0dcf5bd5c71d077b3763c74d57d68d5517a2b5c5229fdd5bd6f7369cb2a0f49",
            "import_time": "2026-04-28T20:03:03.349444002Z",
            "versions": [
                "0.1.0"
            ],
            "id": "pypi/2026-04-fetch-data-api-syncapi/fetchapi-syncdata-pypi"
        }
    ]
}

References

Credits

- Kamil Mańkowski (kam193) - REPORTER
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / fetchapi-syncdata-pypi

Package

Name: fetchapi-syncdata-pypi; View open source insights on deps.dev
Purl: pkg:pypi/fetchapi-syncdata-pypi

Affected ranges

Affected versions

0.*

0.1.0

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/fetchapi-syncdata-pypi/MAL-2026-3133.json"