{"id":"MAL-2026-15811","kind":"package","aliases":["MAL-2026-15811"],"related":[],"title":"Malicious code in syswatch (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (740c9125f18d68081f742b3316d07c54727fb4aab5555a398c0c04e31ba9bb54)\nImporting syswatch starts a background thread that, on Windows, fetches a JSON manifest from https://github-repo.up.railway.app/vbv_a8F3kL92xQ/manifest.json, downloads the executable referenced by manifest.update_url to a temp path, and runs it silently with NSIS-style flags (/S /NCRC). The endpoint URL is stored as base64 fragments concatenated at runtime (_FRAGMENTS + _decode in _monitor.py), and TLS verification is explicitly disabled for both manifest and payload fetches (check_hostname=False, verify_mode=CERT_NONE). After execution the code launches a ServiceHelperUtility.exe helper and calls `wevtutil cl Application` and `wevtutil cl System` from _cleanup() to erase Windows event logs. The host github-repo.up.railway.app is a Railway-hosted lookalike of GitHub, not a GitHub-owned domain. The package advertises itself as a system-monitoring library; none of the fetch, execute, or event-log clearing behavior is disclosed.\n\n## Source: kam193 (e01fd8b85a9d6bdfbefb70261f49496f8a6c224d98da6400ef0ca06f18404d27)\nDuring import, malicious code is started in the background. On Windows, it downloads and installs a malicious executable, and disguises it as a system utility. After installation, the code attempts to cover its tracks by cleaning logs and removing downloaded files. The installed executable is a heavily obfuscated malware with multiple sandbox evasion techniques, finally running an infostealer identifying itself as \"Snow Stealer\". It collects at least browser data and modifies cryptowallet applications.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-envprovision\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - action-hidden-in-lib-usage\n\n\n - exfiltration-browser-data\n\n\n - The package contains code to detect if it is running in a sandbox environment.\n\n\n - exfiltration-crypto\n\n\n - malware\n\n\n - covering-tracks\n\n\n - persistence","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"syswatch","fixed":[],"affected":"= 1.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-01T21:27:36+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","triaged_at":"2026-10-26T21:12:36+00:00","updated_at":"2026-10-26T21:12:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-08':254C '-15811':8A,11A '-2026':7A,10A '/ncrc':67C '/s':66C '/vbv_a8f3kl92xq/manifest.json,':45C '2026':253C '740c9125f18d68081f742b3316d07c54727fb4aab5555a398c0c04e31ba9bb54':28C 'action':270C 'action-hidden-in-lib-usag':269C 'advertis':145C 'amazon':26C 'amazon-inspector':25C 'applic':114C,241C 'attempt':198C 'background':33C,177C 'base':257C 'base64':74C 'behavior':163C 'browser':236C,277C 'call':111C 'campaign':245C,252C,260C 'categori':242C 'cert':100C 'check':95C 'cl':113C,117C 'clean':204C 'cleanup':120C 'clear':162C,247C 'code':2A,105C,172C,197C,282C 'collect':233C 'concaten':76C 'contain':281C 'cover':200C,298C 'covering-track':297C 'crypto':295C 'cryptowallet':240C 'data':237C,278C 'decod':80C 'detail':17C 'detect':284C 'disabl':88C 'disclos':165C 'disguis':188C 'domain':142C 'download':46C,181C,208C,262C 'e01fd8b85a9d6bdfbefb70261f49496f8a6c224d98da6400ef0ca06f18404d27':168C 'edit':20C 'endpoint':69C 'environ':292C 'envprovis':255C 'eras':122C 'evas':221C 'event':124C,160C 'event-log':159C 'execut':48C,103C,157C,186C,212C,264C,267C 'exfiltr':276C,294C 'exfiltration-browser-data':275C 'exfiltration-crypto':293C 'explicit':87C 'fals':97C 'fetch':38C,94C,156C 'file':209C 'final':223C 'flag':65C 'fragment':75C,79C 'github':136C,140C 'github-own':139C 'github-repo.up.railway.app':44C,128C 'github-repo.up.railway.app/vbv_a8f3kl92xq/manifest.json,':43C 'heavili':215C 'helper':109C 'hidden':271C 'host':127C,133C 'hostnam':96C 'identifi':227C 'import':29C,170C 'infosteal':226C,251C,261C 'inspector':27C 'instal':183C,195C,211C 'intent':249C 'json':40C 'kam193':167C 'launch':106C 'least':235C 'lib':273C 'librari':152C 'like':250C 'line':23C 'log':125C,161C,205C 'lookalik':134C 'mal':6A,9A 'malici':1A,13B,171C,185C,243C,248C 'malwar':217C,296C 'manifest':41C,91C 'manifest.update':51C 'mode':99C 'modifi':239C 'monitor':151C 'monitor.py':82C 'multipl':219C 'none':101C,153C 'nsis':63C 'nsis-styl':62C 'obfusc':216C,268C 'own':141C 'packag':14B,144C,280C 'path':56C 'payload':93C 'per':15C 'persist':300C 'pypi':5A 'railway':132C 'railway-host':131C 'reason':256C 'referenc':49C 'remot':266C 'remov':207C 'run':58C,224C,288C 'runtim':78C 'sandbox':220C,291C 'servicehelperutility.exe':108C 'silent':60C 'snow':230C 'sourc':16C,24C,166C 'start':31C,174C 'stealer':231C 'store':72C 'style':64C 'system':118C,150C,192C 'system-monitor':149C 'syswatch':4A,12A,30C 'techniqu':222C 'temp':55C 'thread':34C 'tls':84C 'track':202C,299C 'url':52C,70C 'usag':274C 'util':193C 'verif':85C 'verifi':98C 'wevtutil':112C,116C 'window':37C,123C,179C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-01T21:27:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-15811","url":"https://osv.dev/vulnerability/MAL-2026-15811","severity":"critical","published_at":"2026-09-01T21:27:36+00:00","modified_at":"2026-09-02T03:00:07+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","fetched_at":"2026-10-26T20:51:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}