MAL-2026-4285

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/polydata-analytics/MAL-2026-4285.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4285
Published
2026-05-24T18:22:39Z
Modified
2026-05-26T06:03:12.126707611Z
Summary
Malicious code in polydata-analytics (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (04c2f2ae400ee7411678735073e22d4c662de5653a4add84eaca159ed0ba004a)

Package self-describes as a Polymarket market-data analytics tool but ships a Windows clipboard monitor (src/polymarketdatafetcher/clipper/winclip.py) that detects copied BTC/ETH/SOL/TRX/Polygon/BSC wallet addresses and silently overwrites them with attacker-controlled replacement addresses, redirecting cryptocurrency transfers to the attacker. The replacement address table and persistence configuration are stored as XOR-encrypted blobs (W and P) in src/polymarketdatafetcher/obf.py and decoded at runtime via eval() of a host-key-derived decryption, hiding the attacker wallets from static review. The package installs four redundant persistence vectors per platform: on Linux, ~/.config/autostart/data-fetcher.desktop, a user systemd service d-clipper-user.service, an appended background launcher line in ~/.bashrc/~/.profile, and an @reboot crontab entry; on Windows, an HKCU...\Run\DataFetcher registry value, a Startup-folder shortcut, an sc-created DataService service when admin, and a schtasks /sc onlogon /rl highest scheduled task named DataUpdater; on macOS, a ~/Library/LaunchAgents/com.datafetcher.plist with RunAtLoad, Folder Actions registration, and an osascript-added login item named 'Data Sync'. Every malicious code path is gated by an anti-analysis check (src/polymarketdatafetcher/utils.py) that enumerates VBoxManage, VMware, VirtualBox, QEMU, Wireshark, IDA, OllyDbg, Process Hacker and aborts on sandbox-shaped usernames — characteristic malware shape, never present in legitimate analytics tooling. The advertised fetchmarketdata() function is a thin wrapper around polymarket.com/gamma/markets and exists only as cover; main.py invokes bgservices() and an infinite sleep loop, so running the bundled polydata-fetcher CLI launches the clipper and persistence in the background. Author metadata is placeholder ('Data Analytics Team data-team@analytics.dev') with no real publisher identity.

Source: kam193 (1b11035719acc6b849ae1ecc983db8841fd3676b4628ebcef0a24392d872eb5e)

The code attempts to monitor the clipboard and replace copied cryptocurrency addresses, as well as establish persistence.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-polymarket-data-fetcher

Reasons (based on the campaign):

  • peristence-autorun

  • obfuscation

  • crypto-related

  • The package contains code to detect if it is running in a sandbox environment.

  • clipboard-modify

  • persistence

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-05-24T18:54:37.081463229Z",
            "versions": [
                "1.3.0",
                "1.3.1"
            ],
            "modified_time": "2026-05-24T18:32:49.982517Z",
            "sha256": "1b11035719acc6b849ae1ecc983db8841fd3676b4628ebcef0a24392d872eb5e",
            "id": "pypi/2026-05-polymarket-data-fetcher/polydata-analytics",
            "source": "kam193"
        },
        {
            "import_time": "2026-05-26T05:52:46.316096764Z",
            "source": "amazon-inspector",
            "modified_time": "2026-05-24T18:22:39Z",
            "id": "IN-MAL-2026-004523",
            "sha256": "04c2f2ae400ee7411678735073e22d4c662de5653a4add84eaca159ed0ba004a",
            "versions": [
                "1.3.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / polydata-analytics

Package

Name
polydata-analytics
View open source insights on deps.dev
Purl
pkg:pypi/polydata-analytics

Affected ranges

Affected versions

1.*
1.3.0
1.3.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "polydata_analytics-1.3.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "9e2f72d3d7362616aad360139874c7509e335785832be974dc593ef617f5df62",
                "sha256": "e4aa0f5f4ab1b9f85466f2cf5dc3b9d7b3595a633ef1a83fbedb75fcf3fa0cf6",
                "md5": "d5c886b3943d47bd84a04d9206e52231"
            }
        },
        {
            "filename": "polydata_analytics-1.3.0.tar.gz",
            "hashes": {
                "blake2b_256": "40067313ff97129f750b58478da47cf32adb0c128ccc783c40b76a0f6e6862d7",
                "sha256": "bbd87e5884c65a95e50c914f937caf855d183535ede3274ce18b61bb3b57e49f",
                "md5": "835efa0afc7ef927e71970ea9ebf8cb3"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "src/polymarket_data_fetcher/_clipper/win_clip.py",
            "sha256": "39cec6c7d3842be4d8f0d1d03876ceded1c3a3278214d99ded288f57c2f4970a",
            "tlsh": "c241325254ad5c62c233749f7813926227573d2f4d4838a43caceb145faa0ba50fb3b8"
        },
        {
            "path": "src/polymarket_data_fetcher/_obf.py",
            "sha256": "37ca07a4458697be9167019ec5f6c6dbc15d27178f15f69ad72103814779313a",
            "tlsh": "d93142d39e6cd1e09796da081a0089a6124ce53b86db471cead5223bfb8842591f13f0"
        },
        {
            "path": "src/polymarket_data_fetcher/_persist/linux_persist.py",
            "sha256": "74f6c3db64a4e48351095749a4739752ada7ac7d86619051cfa7e1d38b7c0546",
            "tlsh": "25a104f9a96a6971c3b3d37e8502c0d20e893c93da0b5474f4ec4561af89174c2b4f9e"
        },
        {
            "path": "src/polymarket_data_fetcher/_persist/win_persist.py",
            "sha256": "1db34ef26bc3e6d4e6418f8c184ba103fddb505f834a92b3f4c323957f46dbf6",
            "tlsh": "b6a12265e9576931c723d1aa5006c4826bcb3c93a1496c35b6fc51b0bf450bac2fceeb"
        },
        {
            "path": "src/polymarket_data_fetcher/_persist/darwin_persist.py",
            "sha256": "6f8f578087ab222ff493821cc4bd5e694b5803788fdb7c4a9a852ad3e3e8b9c6",
            "tlsh": "cf7132a5096e64b087e3e37a4546c0d31b8a7cd3ba0b5838f4fc54a0af455b582f4e9a"
        },
        {
            "path": "src/polymarket_data_fetcher/_utils.py",
            "sha256": "d3a43b20000ac539ee35ec1a280a71bec0be1face7e954f961ccca61793adec4",
            "tlsh": "835100d7ea60685593e3d25a99478086125c6d33ce46ac38bddc1220ef2d55e83b0bfd"
        },
        {
            "path": "pyproject.toml",
            "sha256": "8d817d4cfb3808d70355f024f328eca1c9275b41f258bf1fb9aaaa0eda4d28a4",
            "tlsh": "b221327bf8d62c258bc361c560a44a00fe7116233dd4d45e3bdb420c876d96750f9839"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/polydata-analytics/MAL-2026-4285.json"