MAL-2026-6561

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/skillspector/MAL-2026-6561.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6561
Published
2026-06-28T21:50:42Z
Modified
2026-07-08T20:47:15.360607451Z
Summary
Malicious code in skillspector (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8c77584b4e40db9023ca0b8a90fa1bd611c859ed486f99ca3a7c9a83dbfa9877)

This package presents itself as a redistribution of NVIDIA/skillspector (pyproject Homepage points to github.com/NVIDIA/skillspector and the source carries NVIDIA copyright headers) but ships an added telemetry.py module whose own header notes it is not part of the upstream project. telemetry.py hardcodes DEFAULTTELEMETRYENDPOINT = "https://livekit-agents.xyz/skillspector-telemetry" and is enabled by default (SKILLSPECTORTELEMETRY defaults to '1'). On every skillspector CLI invocation, an @app.callback() hook POSTs a payload containing the installer's hostname (platform.node), username (getpass.getuser), current working directory (os.getcwd), a persistent installid UUID, OS, arch, Python version, and timestamp to that endpoint. The behavior directly contradicts the README's 'Usage telemetry' section, which states that nothing is sent unless an operator explicitly sets SKILLSPECTORTELEMETRYURL and that usernames, hostnames, and environment values are never sent. The destination domain is unrelated to the declared publisher (NVIDIA). Hostname + username + cwd shipped by default to a non-publisher domain whose documentation explicitly disclaims this collection is covert exfiltration of installer identity, not consensual telemetry.

Source: kam193 (3c5f440b1893b0d6aad59302e3cef3c14e1ae5b51b83144474e8126b3d2f9075)

This package is a modified, unofficial version of the Nvidia project (https://github.com/NVIDIA/skillspector). The modification is disguised as telemetry. The project's README describes the telemetry as opt-in, anonymous usage reporting of selected data added by the redistributor. In fact the "telemetry" uses a default domain suggesting (impersonating) it belongs to Nvidia's LiveKit project and exfiltrates full command arguments on every CLI invocation.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-skillspector

Reasons (based on the campaign):

  • The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

  • exfiltration-generic

  • dependency-confusion

  • clones-real-package

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-28T22:26:30.226402805Z",
            "source": "kam193",
            "versions": [
                "0.0.1",
                "0.0.2",
                "0.0.3",
                "0.0.4",
                "2.3.7",
                "2.3.8",
                "2.3.9",
                "2.3.10"
            ],
            "id": "pypi/2026-06-skillspector/skillspector",
            "modified_time": "2026-06-28T21:50:42.968173Z",
            "sha256": "939ac54a8a665e3e0c6f1c33a59d8a3afb0d3d2c827c30a701973777cd39ff19"
        },
        {
            "import_time": "2026-06-28T23:28:15.10964739Z",
            "id": "pypi/2026-06-skillspector/skillspector",
            "versions": [
                "0.0.1",
                "0.0.2",
                "0.0.3",
                "0.0.4",
                "2.3.7",
                "2.3.8",
                "2.3.9",
                "2.3.10"
            ],
            "source": "kam193",
            "modified_time": "2026-06-28T21:50:42.968173Z",
            "sha256": "3c5f440b1893b0d6aad59302e3cef3c14e1ae5b51b83144474e8126b3d2f9075"
        },
        {
            "import_time": "2026-07-01T22:02:59.03190481Z",
            "source": "amazon-inspector",
            "versions": [
                "2.3.9"
            ],
            "id": "IN-MAL-2026-007905",
            "modified_time": "2026-07-01T21:06:55Z",
            "sha256": "8c77584b4e40db9023ca0b8a90fa1bd611c859ed486f99ca3a7c9a83dbfa9877"
        },
        {
            "import_time": "2026-07-08T20:32:38.227429174Z",
            "source": "amazon-inspector",
            "versions": [
                "0.0.4"
            ],
            "id": "IN-MAL-2026-008510",
            "modified_time": "2026-07-08T20:21:28Z",
            "sha256": "1ea9ea6613a55477261d5852fc6cd885c3f5afdd77337eed39128657de73e49b"
        },
        {
            "import_time": "2026-07-08T20:32:28.919577505Z",
            "source": "amazon-inspector",
            "versions": [
                "2.3.10"
            ],
            "id": "IN-MAL-2026-008439",
            "modified_time": "2026-07-08T20:10:43Z",
            "sha256": "920c1c34483919064f8f8e89c01688d1bf8b305fe35388e8e87b9c35b4002229"
        }
    ],
    "iocs": {
        "urls": [
            "https://livekit-agents.xyz/skillspector-telemetry"
        ],
        "domains": [
            "livekit-agents.xyz"
        ]
    }
}
References
Credits

Affected packages

PyPI / skillspector

Package

Name
skillspector
View open source insights on deps.dev
Purl
pkg:pypi/skillspector

Affected ranges

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
2.*
2.3.7
2.3.8
2.3.9
2.3.10

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/skillspector/MAL-2026-6561.json"
indicators 
{
    "evidence_files": [
        {
            "path": "src/skillspector/telemetry.py",
            "tlsh": "ad91930ad7526a709bab8665593fc0d0e33265d72e402334f4ac83283fae524e6f16f5",
            "sha256": "82d282569f9fb87c2ae15f5547385f81d914ed2d1f7a7f8aacf3bd2dc543efdc"
        }
    ],
    "package_integrity": [
        {
            "filename": "skillspector-2.3.9-py3-none-any.whl",
            "hashes": {
                "sha256": "ce63c164c163c1848a7dbbd879d9249f869d2d224e16efa570f07cf8ebf23e7d",
                "blake2b_256": "8dd8122444c43c9023bbc3690320a36f43facfef9baceda1c092070ecb5f27b8",
                "md5": "5ea46a75dce2e1ad0ebba4c59d24f198"
            }
        },
        {
            "filename": "skillspector-2.3.9.tar.gz",
            "hashes": {
                "sha256": "759443aa264a96e32b0725e468e3b6d7df230d0e537493c388f37a66445177aa",
                "blake2b_256": "b3855454fe3e2014b537ed0d4283736cc6d2f4de68da38384547db4e37c24e2f",
                "md5": "e78157087f8d7dc0902ecc55f3f3c702"
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]