MAL-2026-6244

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/d0rk3r-telemetry/MAL-2026-6244.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6244
Published
2026-06-20T19:08:37Z
Modified
2026-06-23T15:46:42Z
Summary
Malicious code in d0rk3r-telemetry (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (da4542d225ef144ecc5df2f578104ffc12659196c57b2214ecb54f60620601c6)

On import d0rk3r_telemetry, the package spawns a background thread that reads installer-owned secrets and POSTs them to an attacker-controlled endpoint. Specifically, d0rk3r_telemetry/__init__.py reads ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.aws/credentials, and ~/.gitconfig from the installer's home directory, and iterates os.environ collecting every variable whose key contains key, token, secret, password, or api. The collected payload is gzipped and POSTed to a URL reconstructed at runtime by base64-decoding string fragments that resolve to https://analytics-collector.herokuapp.com/events — a Heroku app unrelated to the package's claimed publisher domain. The transmission path includes a sandbox-evasion gate that detects /proc/cpuinfo hypervisor markers, /.dockerenv, and CI environment variables and returns early when any are present, so the exfiltration only fires on real developer workstations. Source comments explicitly self-describe the behavior (# HIDDEN Functionality (malicious but disguised), # Actually: Steal SSH keys, AWS creds, etc., # Actually: Steal API keys!). The package name uses leetspeak digit substitution consistent with a typosquat lure.

Source: kam193 (1f9f4d4943d02f9c78e513a75b4b0fcfd47d1e0486e79df9fe52f2112d840163)

During import, package exfiltrates browsers data, SSH keys and other credential files, env variables and other sensitive data.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-request-cache-py

Reasons (based on the campaign):

  • infostealer

  • exfiltration-env-variables

  • exfiltration-ssh-keys

  • impersonation

  • A Telegram webhook is used to send collected data.

  • exfiltration-browser-data

  • The package contains code to detect if it is running in a sandbox environment.

  • exfiltration-credentials

  • The malicious code is intentionally included in a dependency of the package

Database specific 
{
    "iocs": {
        "domains": [
            "analytics-collector.herokuapp.com"
        ],
        "urls": [
            "https://analytics-collector.herokuapp.com/events"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-06-request-cache-py/d0rk3r-telemetry",
            "import_time": "2026-06-20T19:34:59.734252828Z",
            "modified_time": "2026-06-20T19:08:37.653886Z",
            "sha256": "1f9f4d4943d02f9c78e513a75b4b0fcfd47d1e0486e79df9fe52f2112d840163",
            "source": "kam193",
            "versions": [
                "1.0.0",
                "1.0.1"
            ]
        },
        {
            "id": "pypi/2026-06-request-cache-py/d0rk3r-telemetry",
            "import_time": "2026-06-20T20:33:32.527867481Z",
            "modified_time": "2026-06-20T19:08:37.653886Z",
            "sha256": "882e2e2a2c26ff69be44b64ab738e5ac2739532bde40633a8c6862363ed6c47a",
            "source": "kam193",
            "versions": [
                "1.0.0",
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-007226",
            "import_time": "2026-06-23T15:33:52.729666427Z",
            "modified_time": "2026-06-23T15:20:04Z",
            "sha256": "ce2c34aed3277a5c8efe2459ed3efef0173f818c1f51f1d3dac996985dffbef0",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-007225",
            "import_time": "2026-06-23T15:33:52.699188684Z",
            "modified_time": "2026-06-23T15:19:59Z",
            "sha256": "da4542d225ef144ecc5df2f578104ffc12659196c57b2214ecb54f60620601c6",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / d0rk3r-telemetry

Package

Name
d0rk3r-telemetry
View open source insights on deps.dev
Purl
pkg:pypi/d0rk3r-telemetry

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "d0rk3r_telemetry/__init__.py",
            "sha256": "59fe5578fe37d4c4ab03c552d48b68b4eaf916c4606eb1c7b225d29eb9ecd640",
            "tlsh": "b4912245aab57420e29791bf8867d042733b7d436e01347cb9ac9374afcc226d2f16b9"
        },
        {
            "path": "setup.py",
            "sha256": "f6eca0e6a322ba52e5af4e0d1d0de3e2a0d3bf536f434dd1eeb214a59e3525b5",
            "tlsh": "6501ce7566c521916ac2d55258af59c9e9b942233d80b8a0706c83043f8e1ef8ab737a"
        }
    ],
    "package_integrity": [
        {
            "filename": "d0rk3r_telemetry-1.0.0.tar.gz",
            "hashes": {
                "blake2b_256": "3139463f5fc79f0adf2c397abcc280d18f2a8809a4e7a2eb34feeb5a332c2c3e",
                "md5": "a1562d94a4c5c7fb2602e46ac26b9137",
                "sha256": "b613ffb8628fca1f7b0a55f0584558bd20c8ad4e83bc9cf8c35f387f31911e6e"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/d0rk3r-telemetry/MAL-2026-6244.json"