{"id":"MAL-2026-15827","kind":"package","aliases":["MAL-2026-15827"],"related":[],"title":"Malicious code in company-sdk (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (46a5156bc1c582f0be8c1c33340b338cba12276dd9ea90235210fbc2ff950c85)\ncompany_sdk.py executes credential-harvesting code at module import time. It walks the installer's home directory reading SSH keys (~/.ssh), cloud credentials (~/.aws, ~/.azure, ~/.config/gcloud), package manager tokens (~/.npmrc, ~/.pypirc, ~/.netrc, ~/.pgpass), Docker/Kube configs,.env files, Vault/Terraform tokens, and shell history, and enumerates process environment variables whose names match credential keywords (TOKEN, SECRET, KEY, PASSWORD, AWS_, GITHUB_, etc.). The collected material is gzip-compressed, XOR-encrypted with a keystream derived via PBKDF2-HMAC-SHA256 from a hardcoded 32-byte hex passphrase, HMAC-tagged, and base64-encoded. The _drop() function then POSTs the encrypted blob to https://api.github.com/gists using a hardcoded ghp_-prefixed GitHub Personal Access Token as the Bearer credential, with TLS verification explicitly disabled (ssl.CERT_NONE). The upload runs unconditionally on import inside a bare try/except so failures are silent. Using GitHub Gist as the drop channel routes the exfiltration through a domain that typically bypasses egress filtering, and encrypting the payload with an author-only key conceals contents from network inspection.\n\n## Source: kam193 (f4b45f8532bf4a1b0b6a1b987a12b2ab7e4b626351b48bfffb159beed150983e)\nDuring import, package exfiltrates sensitive files, credentials and env variables to a private GitHub Gist.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-company-sdk\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-env-variables\n\n\n - files-exfiltration\n\n\n - exfiltration-credentials\n\n\n - exfiltration-ssh-keys","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"company-sdk","fixed":[],"affected":"= 0.0.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-03T00:57:34+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","triaged_at":"2026-10-26T21:12:36+00:00","updated_at":"2026-10-26T21:12:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':234C '-15827':10A,13A '-2026':9A,12A '/.aws':56C '/.azure':57C '/.config/gcloud':58C '/.netrc':64C '/.npmrc':62C '/.pgpass':65C '/.pypirc':63C '/.ssh':53C '/gists':136C '2026':233C '32':114C '46a5156bc1c582f0be8c1c33340b338cba12276dd9ea90235210fbc2ff950c85':32C 'access':144C 'amazon':30C 'amazon-inspector':29C 'api.github.com':135C 'api.github.com/gists':134C 'author':196C 'author-on':195C 'aw':89C 'bare':165C 'base':239C 'base64':123C 'base64-encoded':122C 'bearer':148C 'blob':132C 'bypass':186C 'byte':115C 'campaign':225C,232C,242C 'categori':222C 'channel':177C 'clear':227C 'cloud':54C 'code':2A,38C 'collect':93C 'compani':5A,236C 'company':15A 'company-sdk':4A,14A,235C 'company_sdk.py':33C 'compress':98C 'conceal':199C 'config':67C 'content':200C 'credenti':36C,55C,83C,149C,213C,252C 'credential-harvest':35C 'deriv':105C 'detail':21C 'directori':49C 'disabl':154C 'docker/kube':66C 'domain':183C 'drop':126C,176C 'edit':24C 'egress':187C 'encod':124C 'encrypt':101C,131C,190C 'enumer':76C 'env':68C,215C,245C 'environ':78C 'etc':91C 'execut':34C 'exfiltr':180C,210C,244C,249C,251C,254C 'exfiltration-credenti':250C 'exfiltration-env-vari':243C 'exfiltration-ssh-key':253C 'explicit':153C 'f4b45f8532bf4a1b0b6a1b987a12b2ab7e4b626351b48bfffb159beed150983e':206C 'failur':168C 'file':69C,212C,248C 'files-exfiltr':247C 'filter':188C 'function':127C 'ghp':140C 'gist':173C,221C 'github':90C,142C,172C,220C 'gzip':97C 'gzip-compress':96C 'hardcod':113C,139C 'harvest':37C 'hex':116C 'histori':74C 'hmac':109C,119C 'hmac-tag':118C 'home':48C 'import':41C,162C,208C 'infosteal':231C 'insid':163C 'inspect':203C 'inspector':31C 'instal':46C 'intent':229C 'kam193':205C 'key':52C,87C,198C,256C 'keystream':104C 'keyword':84C 'like':230C 'line':27C 'mal':8A,11A 'malici':1A,17B,223C,228C 'manag':60C 'match':82C 'materi':94C 'modul':40C 'name':81C 'network':202C 'none':156C 'packag':18B,59C,209C 'passphras':117C 'password':88C 'payload':192C 'pbkdf2':108C 'pbkdf2-hmac-sha256':107C 'per':19C 'person':143C 'post':129C 'prefix':141C 'privat':219C 'process':77C 'pypi':7A 'read':50C 'reason':238C 'rout':178C 'run':159C 'sdk':6A,16A,237C 'secret':86C 'sensit':211C 'sha256':110C 'shell':73C 'silent':170C 'sourc':20C,28C,204C 'ssh':51C,255C 'ssl.cert':155C 'tag':120C 'time':42C 'tls':151C 'token':61C,71C,85C,145C 'try/except':166C 'typic':185C 'uncondit':160C 'upload':158C 'use':137C,171C 'variabl':79C,216C,246C 'vault/terraform':70C 'verif':152C 'via':106C 'walk':44C 'whose':80C 'xor':100C 'xor-encrypt':99C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-03T00:57:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-15827","url":"https://osv.dev/vulnerability/MAL-2026-15827","severity":"critical","published_at":"2026-09-03T00:57:34+00:00","modified_at":"2026-09-03T03:15:04+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","fetched_at":"2026-10-26T20:51:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}