MAL-2026-4285

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/polydata-analytics/MAL-2026-4285.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4285
Published
2026-05-24T18:22:39Z
Modified
2026-05-26T06:03:12Z
Summary
Malicious code in polydata-analytics (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (04c2f2ae400ee7411678735073e22d4c662de5653a4add84eaca159ed0ba004a)

Package self-describes as a Polymarket market-data analytics tool but ships a Windows clipboard monitor (src/polymarket_data_fetcher/_clipper/win_clip.py) that detects copied BTC/ETH/SOL/TRX/Polygon/BSC wallet addresses and silently overwrites them with attacker-controlled replacement addresses, redirecting cryptocurrency transfers to the attacker. The replacement address table and persistence configuration are stored as XOR-encrypted blobs (_W and _P) in src/polymarket_data_fetcher/_obf.py and decoded at runtime via eval() of a host-key-derived decryption, hiding the attacker wallets from static review. The package installs four redundant persistence vectors per platform: on Linux, ~/.config/autostart/data-fetcher.desktop, a user systemd service d-clipper-user.service, an appended background launcher line in /.bashrc//.profile, and an @reboot crontab entry; on Windows, an HKCU...\Run\DataFetcher registry value, a Startup-folder shortcut, an sc-created DataService service when admin, and a schtasks /sc onlogon /rl highest scheduled task named DataUpdater; on macOS, a ~/Library/LaunchAgents/com.datafetcher.plist with RunAtLoad, Folder Actions registration, and an osascript-added login item named 'Data Sync'. Every malicious code path is gated by an anti-analysis check (src/polymarket_data_fetcher/_utils.py) that enumerates VBoxManage, VMware, VirtualBox, QEMU, Wireshark, IDA, OllyDbg, Process Hacker and aborts on sandbox-shaped usernames — characteristic malware shape, never present in legitimate analytics tooling. The advertised fetch_market_data() function is a thin wrapper around polymarket.com/gamma/markets and exists only as cover; main.py invokes _bg_services() and an infinite sleep loop, so running the bundled polydata-fetcher CLI launches the clipper and persistence in the background. Author metadata is placeholder ('Data Analytics Team data-team@analytics.dev') with no real publisher identity.

Source: kam193 (1b11035719acc6b849ae1ecc983db8841fd3676b4628ebcef0a24392d872eb5e)

The code attempts to monitor the clipboard and replace copied cryptocurrency addresses, as well as establish persistence.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-polymarket-data-fetcher

Reasons (based on the campaign):

  • peristence-autorun

  • obfuscation

  • crypto-related

  • The package contains code to detect if it is running in a sandbox environment.

  • clipboard-modify

  • persistence

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-05-polymarket-data-fetcher/polydata-analytics",
            "import_time":  "2026-05-24T18:54:37.081463229Z",
            "modified_time":  "2026-05-24T18:32:49.982517Z",
            "sha256":  "1b11035719acc6b849ae1ecc983db8841fd3676b4628ebcef0a24392d872eb5e",
            "source":  "kam193",
            "versions":  [
                "1.3.0",
                "1.3.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-004523",
            "import_time":  "2026-05-26T05:52:46.316096764Z",
            "modified_time":  "2026-05-24T18:22:39Z",
            "sha256":  "04c2f2ae400ee7411678735073e22d4c662de5653a4add84eaca159ed0ba004a",
            "source":  "amazon-inspector",
            "versions":  [
                "1.3.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / polydata-analytics

Package

Name
polydata-analytics
View open source insights on deps.dev
Purl
pkg:pypi/polydata-analytics

Affected ranges

Affected versions

1.*
1.3.0
1.3.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "src/polymarket_data_fetcher/_clipper/win_clip.py",
            "sha256":  "39cec6c7d3842be4d8f0d1d03876ceded1c3a3278214d99ded288f57c2f4970a",
            "tlsh":  "c241325254ad5c62c233749f7813926227573d2f4d4838a43caceb145faa0ba50fb3b8"
        },
        {
            "path":  "src/polymarket_data_fetcher/_obf.py",
            "sha256":  "37ca07a4458697be9167019ec5f6c6dbc15d27178f15f69ad72103814779313a",
            "tlsh":  "d93142d39e6cd1e09796da081a0089a6124ce53b86db471cead5223bfb8842591f13f0"
        },
        {
            "path":  "src/polymarket_data_fetcher/_persist/linux_persist.py",
            "sha256":  "74f6c3db64a4e48351095749a4739752ada7ac7d86619051cfa7e1d38b7c0546",
            "tlsh":  "25a104f9a96a6971c3b3d37e8502c0d20e893c93da0b5474f4ec4561af89174c2b4f9e"
        },
        {
            "path":  "src/polymarket_data_fetcher/_persist/win_persist.py",
            "sha256":  "1db34ef26bc3e6d4e6418f8c184ba103fddb505f834a92b3f4c323957f46dbf6",
            "tlsh":  "b6a12265e9576931c723d1aa5006c4826bcb3c93a1496c35b6fc51b0bf450bac2fceeb"
        },
        {
            "path":  "src/polymarket_data_fetcher/_persist/darwin_persist.py",
            "sha256":  "6f8f578087ab222ff493821cc4bd5e694b5803788fdb7c4a9a852ad3e3e8b9c6",
            "tlsh":  "cf7132a5096e64b087e3e37a4546c0d31b8a7cd3ba0b5838f4fc54a0af455b582f4e9a"
        },
        {
            "path":  "src/polymarket_data_fetcher/_utils.py",
            "sha256":  "d3a43b20000ac539ee35ec1a280a71bec0be1face7e954f961ccca61793adec4",
            "tlsh":  "835100d7ea60685593e3d25a99478086125c6d33ce46ac38bddc1220ef2d55e83b0bfd"
        },
        {
            "path":  "pyproject.toml",
            "sha256":  "8d817d4cfb3808d70355f024f328eca1c9275b41f258bf1fb9aaaa0eda4d28a4",
            "tlsh":  "b221327bf8d62c258bc361c560a44a00fe7116233dd4d45e3bdb420c876d96750f9839"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "polydata_analytics-1.3.0-py3-none-any.whl",
            "hashes":  {
                "blake2b_256":  "9e2f72d3d7362616aad360139874c7509e335785832be974dc593ef617f5df62",
                "md5":  "d5c886b3943d47bd84a04d9206e52231",
                "sha256":  "e4aa0f5f4ab1b9f85466f2cf5dc3b9d7b3595a633ef1a83fbedb75fcf3fa0cf6"
            }
        },
        {
            "filename":  "polydata_analytics-1.3.0.tar.gz",
            "hashes":  {
                "blake2b_256":  "40067313ff97129f750b58478da47cf32adb0c128ccc783c40b76a0f6e6862d7",
                "md5":  "835efa0afc7ef927e71970ea9ebf8cb3",
                "sha256":  "bbd87e5884c65a95e50c914f937caf855d183535ede3274ce18b61bb3b57e49f"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/polydata-analytics/MAL-2026-4285.json"