{"id":"MAL-2026-14587","kind":"package","aliases":["MAL-2026-14587"],"related":[],"title":"Malicious code in pygame-renderkit (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54)\nsetup.py registers a custom install command that forks a daemonized child during pip install and executes a base64-encoded Python payload via exec(compile(...)). The decoded payload connects to a hardcoded C2 host at 5uj0a8ziyu.localto.net:3900 and provides an interactive reverse shell by duplicating the socket onto stdin/stdout/stderr of /bin/bash (via pty.spawn) or /bin/sh -i, with a 15-second reconnect loop. It also enumerates environment variables matching API, TOKEN, KEY, SECRET, PASS, CRED, AUTH, AWS, AZURE, GCP, OPENAI, ANTHROPIC, and MANUS, reads /etc/passwd, /etc/sudoers, /etc/shadow, ~/.bash_history, and /opt/.manus/current/config, and sends the collected data over TCP to the same host framed with [EXFIL]/[ENDEXFIL] markers. Persistence is established by writing /tmp/.rk_recon.py, installing a per-minute crontab entry, dropping a renderkit.service systemd user unit with Restart=always, and writing /etc/sudoers.d/.renderkit granting the current user NOPASSWD: ALL. The payload is stored as a base64-encoded template with %%HOST%%/%%PORT%% placeholders and the installer forks with start_new_session=True to hide from pip output. The package presents as a pygame utility; none of this behavior matches that stated purpose.\n\n## Source: kam193 (5856daeb3070a9b2a6ffc42d8999ff49c63706ccb27ee683e5fcc4ff175f78f9)\nDuring installation, the package attempts to exfiltrate sensitive environment variables and files, establish persistence and open reverse shell.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-pygame-renderkit\n\n\nReasons (based on the campaign):\n\n\n - persistence\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.\n\n\n - files-exfiltration\n\n\n - exfiltration-env-variables","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pygame-renderkit","fixed":[],"affected":"= 1.2.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-08-28T09:55:47+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","triaged_at":"2026-10-26T21:12:36+00:00","updated_at":"2026-10-26T21:12:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-08':244C '-14587':10A,13A '-2026':9A,12A '/.bash_history':118C '/bin/bash':82C '/bin/sh':86C '/etc/passwd':115C '/etc/shadow':117C '/etc/sudoers':116C '/etc/sudoers.d/.renderkit':161C '/opt/.manus/current/config':120C '/tmp/.rk_recon.py':142C '15':90C '2026':243C '5856daeb3070a9b2a6ffc42d8999ff49c63706ccb27ee683e5fcc4ff175f78f9':213C '5uj0a8ziyu.localto.net:3900':68C 'allow':277C 'also':95C 'alway':158C 'amazon':30C 'amazon-inspector':29C 'anthrop':111C 'api':100C 'attack':279C 'attempt':218C 'auth':106C 'aw':107C 'azur':108C 'base':249C 'base64':51C,175C 'base64-encoded':50C,174C 'behavior':206C 'c2':65C 'campaign':235C,242C,252C 'categori':232C 'child':43C 'clear':237C 'code':2A,265C,271C 'collect':124C 'command':38C,259C,283C 'compil':57C 'connect':61C 'contain':270C 'creat':273C 'cred':105C 'crontab':148C 'current':164C 'custom':36C 'daemon':42C 'data':125C 'decod':59C 'detail':21C 'drop':150C 'duplic':76C 'edit':24C 'encod':52C,176C 'endexfil':135C 'entri':149C 'enumer':96C 'env':294C 'environ':97C,222C 'establish':139C,226C 'exec':56C 'execut':48C,263C,281C 'exfil':134C 'exfiltr':220C,291C,293C 'exfiltration-env-vari':292C 'fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54':32C 'file':225C,290C 'files-exfiltr':289C 'fork':40C,185C 'frame':132C 'gcp':109C 'grant':162C 'hardcod':64C 'hide':192C 'host':66C,131C,179C 'infosteal':241C 'inspector':31C 'instal':37C,46C,143C,184C,215C,258C,267C 'intent':239C 'interact':72C 'kam193':212C 'key':102C 'like':240C 'line':27C 'loop':93C 'machin':288C 'mal':8A,11A 'malici':1A,17B,233C,238C,264C 'manus':113C 'marker':136C 'match':99C,207C 'minut':147C 'new':188C 'none':203C 'nopasswd':166C 'onto':79C 'open':229C 'openai':110C 'output':195C 'overrid':256C 'packag':18B,197C,217C,255C,269C 'pass':104C 'payload':54C,60C,169C 'per':19C,146C 'per-minut':145C 'persist':137C,227C,253C 'pip':45C,194C 'placehold':181C 'port':180C 'present':198C 'provid':70C 'pty.spawn':84C 'purpos':210C 'pygam':5A,201C,246C 'pygame':15A 'pygame-renderkit':4A,14A,245C 'pypi':7A 'python':53C 'read':114C 'reason':248C 'reconnect':92C 'regist':34C 'renderkit':6A,16A,247C 'renderkit.service':152C 'restart':157C 'revers':73C,230C,275C 'second':91C 'secret':103C 'send':122C 'sensit':221C 'session':189C 'setup.py':33C,261C 'shell':74C,231C,276C 'socket':78C 'sourc':20C,28C,211C 'start':187C 'state':209C 'stdin/stdout/stderr':80C 'store':171C 'systemd':153C 'tcp':127C 'templat':177C 'token':101C 'true':190C 'unit':155C 'user':154C,165C 'util':202C 'variabl':98C,223C,295C 'via':55C,83C 'victim':286C 'write':141C,160C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-28T09:55:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-14587","url":"https://osv.dev/vulnerability/MAL-2026-14587","severity":"critical","published_at":"2026-08-28T09:55:47+00:00","modified_at":"2026-08-29T12:30:09+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","fetched_at":"2026-10-26T20:51:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}