MAL-2026-5345

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dstill/MAL-2026-5345.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5345
Published
2026-06-09T10:15:49Z
Modified
2026-08-27T13:45:13Z
Summary
Malicious code in dstill (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (698645f1cbbe41dbe7b65f3cf373ed38f59cb59ca9cc0bb25bd9d175114f1762)

On import spaysdata, init.py invokes main_entry() which executes a multi-stage Windows infostealer with no relation to the package's advertised purpose (a 'Roblox DataStore' library). Behaviors: (1) reads %USERPROFILE%\AppData\Local\Roblox\LocalStorage\robloxcookies.dat, decrypts via CryptUnprotectData, and POSTs the plaintext cookies to a hardcoded Discord webhook (discord.com/api/webhooks/1513807955340820602/...) and a Google Apps Script endpoint (script.google.com/macros/s/AKfycbwa8sLEdsG_leFVecuc.../exec); (2) kills Discord processes via taskkill /f /im Discord.exe, then enumerates Discord/Discord Canary/PTB/Lightcord and ~20 Chromium browsers (Chrome, Edge, Brave, Yandex, Opera, Vivaldi,...) plus Firefox profiles, AES-GCM-decrypts tokens with each browser's DPAPI master key, validates them against the Discord API, and exfiltrates working tokens to the same endpoints; (3) installs persistence by copying itself to %LOCALAPPDATA%\MicrosoftSecurityWorker\WindowsSecurity.{pyw,exe}, registers that directory as a Windows Defender ExclusionPath via PowerShell Add-MpPreference, and creates a schtasks /sc onlogon /rl highest task named 'WindowsSecurityUpdate' to run at every logon. The Microsoft-lookalike paths/names are explicit AV evasion. Russian/Ukrainian comments in the source acknowledge the stealth and anti-AV intent. The pyproject description in Russian ('Библиотека для работы с DataStore в Roblox') is a lure targeting Roblox developers.

Source: kam193 (09fdc0fbdc8b1ba29a63f2807ec9c9af6dd1079a5ac6fa99c88b54df9bd22a0b)

The package exfiltrates Roblox cookies from the victim machine.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-spaysrbdata

Reasons (based on the campaign):

  • infostealer
Database specific 
{
    "iocs":  {
        "urls":  [
            "https://script.google.com/macros/s/AKfycbwa8sLEdsG_leFVecuc_dFrZ_h5JnZKrWxXWazK1T6DoKGAGG5OJ9rznwYXg2PS-h1d/exec",
            "https://discord.com/api/webhooks/1513807955340820602/-UbLOjMGWIop17hrvQ7XsrZkJBJaNlMTueX7xnsJ9hz6DKaBgSe_Ur2FIgSJMHlusBwx"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-06-spaysrbdata/dstill",
            "import_time":  "2026-06-09T10:41:59.930161705Z",
            "modified_time":  "2026-06-09T10:15:49.782378Z",
            "sha256":  "09fdc0fbdc8b1ba29a63f2807ec9c9af6dd1079a5ac6fa99c88b54df9bd22a0b",
            "source":  "kam193",
            "versions":  [
                "0.3.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-005343",
            "import_time":  "2026-06-11T01:21:50.613265409Z",
            "modified_time":  "2026-06-11T00:21:06Z",
            "sha256":  "698645f1cbbe41dbe7b65f3cf373ed38f59cb59ca9cc0bb25bd9d175114f1762",
            "source":  "amazon-inspector",
            "versions":  [
                "0.3.0"
            ]
        },
        {
            "id":  "pypi/2026-06-spaysrbdata/dstill",
            "import_time":  "2026-07-24T20:00:55.336913947Z",
            "modified_time":  "2026-06-09T10:15:49.782378Z",
            "sha256":  "4813bbeca5498693b44caa531195a9b29c9cdb89b377a8ea36a4bb14b9951ca0",
            "source":  "kam193",
            "versions":  [
                "0.3.0"
            ]
        },
        {
            "id":  "pypi/2026-06-spaysrbdata/dstill",
            "import_time":  "2026-08-27T13:37:01.767939402Z",
            "modified_time":  "2026-06-09T10:15:49.782378Z",
            "sha256":  "b53a8f990462b79737cb0228e5c4c1d249d362b72afdac3290afd82c0e22d21f",
            "source":  "kam193",
            "versions":  [
                "0.3.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / dstill

Package

Name
dstill
View open source insights on deps.dev
Purl
pkg:pypi/dstill

Affected ranges

Affected versions

0.*
0.3.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "spaysdata/main.py",
            "sha256":  "8d609f7ccd0e47fe743299781b79230d96f8944fcba58b24d14950a113ca5908",
            "tlsh":  "34527546ec4e041a9236914de856e94cfa6702ab767113033afca7b83f75031d3792ee"
        },
        {
            "path":  "pyproject.toml",
            "sha256":  "4ec8516ee89dee5e8ad3573a8c5373c88d19d6708914393403d02717fc2d68ab",
            "tlsh":  "4df0dd73dd796c3091b4708696608a08fea1707a36d400fa32dab1ed15aa350cfac63c"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "dstill-0.3.0-py3-none-any.whl",
            "hashes":  {
                "blake2b_256":  "a8e5a2c2248cd9b43dbd71e4fd196a8595a6f81e6b51097f0dc04da79d2f8e25",
                "md5":  "f88915195f6f180c75fc4e4e2b2199a6",
                "sha256":  "463ee054c7779369155784fa38cc3ae22a175976c781faa84b0f4f93d1f54f7c"
            }
        },
        {
            "filename":  "dstill-0.3.0.tar.gz",
            "hashes":  {
                "blake2b_256":  "49d49f29d6f84954f1407505eafa69b2affe7e0ee01241be0081edb0c23d6f4a",
                "md5":  "2d95893193bdb53f79e4db64585985f8",
                "sha256":  "3264b438b7f827125ecab00a5ab0656af7e6ffc0e6acb5bd384b1bd01ef3953b"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dstill/MAL-2026-5345.json"