{"id":"MAL-2026-14389","kind":"package","aliases":["MAL-2026-14389"],"related":[],"title":"Malicious code in envprovision (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a414ad5404fdeeb23c37f1580aeee8175765ba8613e8fadd1a0254bf0e25d2f6)\nenvprovision 1.4.0 presents itself as an environment-diagnostics helper but its public `check()`/`sync()` API, on Windows, fetches a JSON manifest from a base64-obfuscated URL that decodes to https://env-metadata.up.railway.app/vbv_a8F3kL92xQ/manifest.json, downloads the referenced binary to a temp path, and executes it. TLS verification is disabled on both the manifest fetch and the binary download (ctx.check_hostname=False, ctx.verify_mode=ssl.CERT_NONE), so the payload can also be substituted by any on-path attacker. The dropped binary is invoked with NSIS silent-install flags (`/S`, `/NCRC`) built by character-list concatenation and hidden-window creation flags, then a follow-on `syshelpear.exe` is spawned detached (CREATE_NO_WINDOW|DETACHED_PROCESS) from a user-writable ProgramFiles/LOCALAPPDATA location as a persistence helper. After execution, `wevtutil cl Application` and `wevtutil cl System` are invoked to erase Windows event logs. The endpoint obfuscation, TLS-off fetch-and-execute of an opaque binary from a publisher-mismatched Railway subdomain, silent-install flag assembly, detached helper launch, and anti-forensic log clearing are inconsistent with the advertised diagnostics purpose and constitute an installer-side binary dropper with persistence.\n\n## Source: kam193 (cf3a48b407852ec03ead22bb8c16c03f252ba5fafa5c86ed1a739427e7d7d869)\nExported functions hide the malicious functionality. On Windows, it downloads and installs a malicious executable, and disguises it as a system utility. After installation, the code attempts to cover its tracks by cleaning logs and removing downloaded files. The installed executable is a heavily obfuscated malware with multiple sandbox evasion techniques, finally running an infostealer identifying itself as \"Snow Stealer\". It collects at least browser data and modifies cryptowallet applications.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-envprovision\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - action-hidden-in-lib-usage\n\n\n - covering-tracks\n\n\n - persistence\n\n\n - The package contains code to detect if it is running in a sandbox environment.\n\n\n - obfuscation\n\n\n - malware\n\n\n - infostealer\n\n\n - exfiltration-browser-data\n\n\n - exfiltration-crypto","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"envprovision","fixed":[],"affected":"= 1.2.0; = 1.3.0; = 1.4.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-08-23T21:37:06+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","triaged_at":"2026-10-26T21:12:36+00:00","updated_at":"2026-10-26T21:12:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-08':310C '-14389':8A,11A '-2026':7A,10A '/ncrc':119C '/s':118C '/vbv_a8f3kl92xq/manifest.json,':62C '1.4.0':30C '2026':309C 'a414ad5404fdeeb23c37f1580aeee8175765ba8613e8fadd1a0254bf0e25d2f6':28C 'action':324C 'action-hidden-in-lib-usag':323C 'advertis':212C 'also':98C 'amazon':26C 'amazon-inspector':25C 'anti':204C 'anti-forens':203C 'api':44C 'applic':161C,297C 'assembl':198C 'attack':106C 'attempt':254C 'base':313C 'base64':54C 'base64-obfuscated':53C 'binari':66C,85C,109C,186C,221C 'browser':292C,352C 'built':120C 'campaign':301C,308C,316C 'categori':298C 'cf3a48b407852ec03ead22bb8c16c03f252ba5fafa5c86ed1a739427e7d7d869':227C 'charact':123C 'character-list':122C 'check':42C 'cl':160C,164C 'clean':260C 'clear':207C,303C 'code':2A,253C,336C 'collect':289C 'concaten':125C 'constitut':216C 'contain':335C 'cover':256C,330C 'covering-track':329C 'creat':141C 'creation':130C 'crypto':356C 'cryptowallet':296C 'ctx.check':87C 'ctx.verify':90C 'data':293C,353C 'decod':58C 'detach':140C,144C,199C 'detail':17C 'detect':338C 'diagnost':37C,213C 'disabl':77C 'disguis':244C 'download':63C,86C,237C,264C,317C 'drop':108C 'dropper':222C 'edit':20C 'endpoint':174C 'env-metadata.up.railway.app':61C 'env-metadata.up.railway.app/vbv_a8f3kl92xq/manifest.json,':60C 'environ':36C,346C 'environment-diagnost':35C 'envprovis':4A,29C,311C 'envprovision':12A 'eras':169C 'evas':277C 'event':171C 'execut':72C,158C,182C,242C,268C,319C,322C 'exfiltr':351C,355C 'exfiltration-browser-data':350C 'exfiltration-crypto':354C 'export':228C 'fals':89C 'fetch':47C,82C,180C 'fetch-and-execut':179C 'file':265C 'final':279C 'flag':117C,131C,197C 'follow':135C 'follow-on':134C 'forens':205C 'function':229C,233C 'heavili':271C 'helper':38C,156C,200C 'hidden':128C,325C 'hidden-window':127C 'hide':230C 'hostnam':88C 'identifi':283C 'inconsist':209C 'infosteal':282C,307C,349C 'inspector':27C 'instal':116C,196C,219C,239C,251C,267C 'installer-sid':218C 'intent':305C 'invok':111C,167C 'json':49C 'kam193':226C 'launch':201C 'least':291C 'lib':327C 'like':306C 'line':23C 'list':124C 'locat':152C 'log':172C,206C,261C 'mal':6A,9A 'malici':1A,13B,232C,241C,299C,304C 'malwar':273C,348C 'manifest':50C,81C 'mismatch':191C 'mode':91C 'modifi':295C 'multipl':275C 'none':93C 'nsis':113C 'obfusc':55C,175C,272C,347C 'on-path':103C 'opaqu':185C 'packag':14B,334C 'path':70C,105C 'payload':96C 'per':15C 'persist':155C,224C,332C 'present':31C 'process':145C 'programfiles/localappdata':151C 'public':41C 'publish':190C 'publisher-mismatch':189C 'purpos':214C 'pypi':5A 'railway':192C 'reason':312C 'referenc':65C 'remot':321C 'remov':263C 'run':280C,342C 'sandbox':276C,345C 'side':220C 'silent':115C,195C 'silent-instal':114C,194C 'snow':286C 'sourc':16C,24C,225C 'spawn':139C 'ssl.cert':92C 'stealer':287C 'subdomain':193C 'substitut':100C 'sync':43C 'syshelpear.exe':137C 'system':165C,248C 'techniqu':278C 'temp':69C 'tls':74C,177C 'tls-off':176C 'track':258C,331C 'url':56C 'usag':328C 'user':149C 'user-writ':148C 'util':249C 'verif':75C 'wevtutil':159C,163C 'window':46C,129C,143C,170C,235C 'writabl':150C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-23T21:37:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-14389","url":"https://osv.dev/vulnerability/MAL-2026-14389","severity":"critical","published_at":"2026-08-23T21:37:06+00:00","modified_at":"2026-09-01T22:30:04+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","fetched_at":"2026-10-26T20:51:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}