{"id":"MAL-2026-15910","kind":"package","aliases":["MAL-2026-15910"],"related":[],"title":"Malicious code in timeweave (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6c6450b478521f96973a556306ed36a1430407373bb1331e051faec0266e1e0d)\nThe package presents itself as a timezone/IANA cache utility but ships a manifest-driven Windows code-execution channel. updater.py defines DEFAULT_DB_URL = \"https://timezone.api.globaltimedata.com/latest/db.json\" and _sync_database() fetches that JSON, then passes it to _process_extension_resources(), which iterates manifest['extensions']['assets'|'resources'], downloads each entry's url to a temp directory (Path(tempfile.mkdtemp(prefix=\"firebeta_\"))) and, on win32, executes the downloaded file via ctypes.windll.kernel32.WinExec(cmd, 0) with attacker-supplied args. This flow is reachable from ordinary library use: __init__.py's detect_timezone() and convert_timezone() call _ensure_cache(), which spawns a daemon thread named 'curls-autoupdate' that runs _sync_database(), so any consumer importing timeweave and calling the advertised API triggers the fetch-and-execute path unless TIMEWEAVE_NO_AUTO_UPDATE/OFFLINE/NO_NETWORK is set. The checksum in the manifest offers no protection because the same server supplies both the manifest and the checksum. Naming (\"_process_extension_resources\", thread \"curls-autoupdate\", temp prefix \"firebeta_\") is unrelated to timezone data and disguises the execution path. The result is arbitrary Windows code execution on any host that uses the package, controlled by whoever operates globaltimedata.com.\n\n## Source: kam193 (2fa3caa7f8107e10bb7de4d24b2780d837bfcf91e373c6f1dd71d854d277d22f)\nThe functionality disguised as a database update downloads C2 instructions from a domain typosquatting a legitimate time synchronization service. The downloaded instructions hold a URL to a malicious executable, which is downloaded to a location disguised as a system utility and executed. The executable appears to be a heavily obfuscated infostealer.\n\nCampaign first discovered by Amazon Inspector. It shares similarities with the campaign 2026-08-envprovision.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-timeweave\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - action-hidden-in-lib-usage\n\n\n - infostealer","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"timeweave","fixed":[],"affected":"= 1.6.0; = 1.9.0; = 1.7.0; = 1.4.0; = 1.8.0; = 1.2.0; = 1.1.0; = 1.3.0; = 1.0.0; = 1.5.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-04T05:17:12+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","triaged_at":"2026-10-26T21:12:36+00:00","updated_at":"2026-10-26T21:12:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-08':287C '-09':301C '-15910':8A,11A '-2026':7A,10A '/latest/db.json':56C '0':99C '2026':286C,300C '2fa3caa7f8107e10bb7de4d24b2780d837bfcf91e373c6f1dd71d854d277d22f':222C '6c6450b478521f96973a556306ed36a1430407373bb1331e051faec0266e1e0d':28C 'action':315C 'action-hidden-in-lib-usag':314C 'advertis':145C 'amazon':26C,278C 'amazon-inspector':25C 'api':146C 'appear':267C 'arbitrari':204C 'arg':104C 'asset':74C 'attack':102C 'attacker-suppli':101C 'auto':157C 'autoupd':132C,187C 'base':304C 'c2':231C 'cach':36C,123C 'call':121C,143C 'campaign':274C,285C,292C,299C,307C 'categori':289C 'channel':48C 'checksum':162C,179C 'clear':294C 'cmd':98C 'code':2A,46C,206C 'code-execut':45C 'consum':139C 'control':215C 'convert':119C 'ctypes.windll.kernel32.winexec':97C 'curl':131C,186C 'curls-autoupd':130C,185C 'daemon':127C 'data':195C 'databas':59C,136C,228C 'db':52C 'default':51C 'defin':50C 'detail':17C 'detect':116C 'directori':84C 'discov':276C 'disguis':197C,225C,258C 'domain':235C 'download':76C,94C,230C,243C,254C,308C 'driven':43C 'edit':20C 'ensur':122C 'entri':78C 'envprovis':288C 'execut':47C,92C,152C,199C,207C,251C,264C,266C,310C,313C 'extens':68C,73C,182C 'fetch':60C,150C 'fetch-and-execut':149C 'file':95C 'firebeta':88C,190C 'first':275C 'flow':106C 'function':224C 'globaltimedata.com':219C 'heavili':271C 'hidden':316C 'hold':245C 'host':210C 'import':140C 'infosteal':273C,298C,320C 'init':113C 'inspector':27C,279C 'instruct':232C,244C 'intent':296C 'iter':71C 'json':62C 'kam193':221C 'legitim':238C 'lib':318C 'librari':111C 'like':297C 'line':23C 'locat':257C 'mal':6A,9A 'malici':1A,13B,250C,290C,295C 'manifest':42C,72C,165C,176C 'manifest-driven':41C 'name':129C,180C 'obfusc':272C 'offer':166C 'oper':218C 'ordinari':110C 'packag':14B,30C,214C 'pass':64C 'path':85C,153C,200C 'per':15C 'prefix':87C,189C 'present':31C 'process':67C,181C 'protect':168C 'py':114C 'pypi':5A 'reachabl':108C 'reason':303C 'remot':312C 'resourc':69C,75C,183C 'result':202C 'run':134C 'server':172C 'servic':241C 'set':160C 'share':281C 'ship':39C 'similar':282C 'sourc':16C,24C,220C 'spawn':125C 'suppli':103C,173C 'sync':58C,135C 'synchron':240C 'system':261C 'temp':83C,188C 'tempfile.mkdtemp':86C 'thread':128C,184C 'time':239C 'timeweav':4A,141C,155C,302C 'timeweave':12A 'timezon':117C,120C,194C 'timezone.api.globaltimedata.com':55C 'timezone.api.globaltimedata.com/latest/db.json':54C 'timezone/iana':35C 'trigger':147C 'typosquat':236C 'unless':154C 'unrel':192C 'updat':229C 'update/offline/no_network':158C 'updater.py':49C 'url':53C,80C,247C 'usag':319C 'use':112C,212C 'util':37C,262C 'via':96C 'whoever':217C 'win32':91C 'window':44C,205C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-04T05:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-15910","url":"https://osv.dev/vulnerability/MAL-2026-15910","severity":"critical","published_at":"2026-09-04T05:17:12+00:00","modified_at":"2026-09-04T10:30:06+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","fetched_at":"2026-10-26T20:51:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}