MAL-2026-6541

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pdf-converter-pro/MAL-2026-6541.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6541
Published
2026-06-26T20:35:30Z
Modified
2026-06-29T07:16:43.087229551Z
Summary
Malicious code in pdf-converter-pro (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0b3a5f6d1d39c20feca11d0129f0efa21bdf564586045555b756cc25bce73efc)

Package is advertised as a PDF converter but contains no PDF generation code. Its sole public method TXTtoPDFConverter.createpdf(txtpath, pdfpath) is gated on the literal arguments 'file.txt' and 'file.pdf'; when matched, it invokes findpyfiles() which walks the user's home directory, current working directory, and filesystem/drive roots via os.walk to collect up to 50.py source files, then sendpyfile() POSTs each file's bytes to https://api.telegram.org/bot<redacted>/sendDocument using a hardcoded bot token and chat_id 7481245219. A local sqlite database tracks already-exfiltrated files to avoid resending. Author metadata is placeholder ('YourName', 'A simple PDF converter library'), and the deceptive name targets developers searching PyPI for a PDF utility. Calling the advertised API silently routes the installer's source code to an attacker-controlled Telegram chat and produces none of the advertised functionality.

Source: kam193 (5978e6d195a6e1aed1e705347db44516aca76c3a6e40ef1f47fb83087588ee16)

Package hides code exfiltrating source code files if run as module.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-pdf-converter-pro

Reasons (based on the campaign):

  • files-exfiltration

  • A Telegram webhook is used to send collected data.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-26T21:34:04.24598071Z",
            "id": "pypi/2026-06-pdf-converter-pro/pdf-converter-pro",
            "sha256": "5978e6d195a6e1aed1e705347db44516aca76c3a6e40ef1f47fb83087588ee16",
            "modified_time": "2026-06-26T20:35:30.274325Z",
            "source": "kam193",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "ECOSYSTEM"
                }
            ],
            "import_time": "2026-06-29T07:09:10.674316077Z",
            "id": "IN-MAL-2026-007760",
            "sha256": "0b3a5f6d1d39c20feca11d0129f0efa21bdf564586045555b756cc25bce73efc",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-06-29T05:52:27Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / pdf-converter-pro

Package

Name
pdf-converter-pro
View open source insights on deps.dev
Purl
pkg:pypi/pdf-converter-pro

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "pdf_converter_pro/__init__.py",
            "tlsh": "aad135955de12891d783c3690143b897230a3da36b0a443079fc6be45f449b46afaeed",
            "sha256": "f299bf961b9a8952dcb12ecdae5cdb5c19bc22a03e5abc44632801c92a49f250"
        },
        {
            "path": "pdf_converter_pro-1.0.0.dist-info/METADATA",
            "tlsh": "81d0a9643681a87677eb824c081d35b6d395818000dc2a86c4911ac2828b6de0bd6638",
            "sha256": "cde8de932c7957c230b4e2fdc8312e8bde56dfea2e1c89365e8cc8ddcc561c6d"
        }
    ],
    "package_integrity": [
        {
            "filename": "pdf_converter_pro-1.0.0-py3-none-any.whl",
            "hashes": {
                "sha256": "6bb84b8973f9e4fa601f2815187ae638c48cd8e1324720c9f7049a463712ffa9",
                "blake2b_256": "1151e7e7469d0daa4c1c88afe2e46f6479b1c7d0caa68f4d980464e2c12182ff",
                "md5": "f85083f2ca0a1c765b0fcccad45a6039"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pdf-converter-pro/MAL-2026-6541.json"