{"id":"MAL-2026-16264","kind":"package","aliases":["MAL-2026-16264"],"related":[],"title":"Malicious code in aiosendletter (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (29baa6f2cbfb2ef9907be7830505e33e82b5a1e6a45eb7f995022d09f5841f09)\nThe package advertises itself as a 'safe bug reporter' but its init() function archives the contents of %LOCALAPPDATA%\\logs with shutil.make_archive and POSTs the resulting archive to a hardcoded, non-configurable Cloudflare Workers endpoint at https://sparkling-pine-f202.stilluer-sweden.workers.dev/. The destination is author-controlled, the caller has no way to redirect or disable it, and code comments indicate the target directory is expected to include a Telegram bot token folder — the collected data is credential-adjacent local state leaving the installer's machine. On Windows the same function calls ctypes.windll.shell32.ShellExecuteW with the 'runas' verb to relaunch the interpreter under UAC elevation before performing the archive-and-upload, broadening the set of files reachable for collection. Separately, pyproject.toml declares 'ctypes' as a runtime dependency; ctypes is a Python standard-library module, so pip resolves this name against PyPI and installs whatever package is published there under 'ctypes', executing that third party's code at install time. The cover-story description, the hardcoded off-host destination for locally-collected data, the privilege escalation, and the stdlib-name dependency-confusion vector jointly constitute an active supply-chain attack on installers.\n\n## Source: kam193 (4e81e3b63bbe719f6d0bdd42930bb2f3235b8e41cbacf449743bb7dca67c9f08)\nPackage hides code to exfiltrate files. Most releases target unclear files, but some reveal the goal to exfiltrate sensitive Telegram data.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-aiosendletter\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - target:telegram","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"aiosendletter","fixed":[],"affected":"= 0.2.0; = 3.7; = 3.8; = 3.9; = 4.0; = 4.1; = 4.3; = 4.5; = 4.6","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-17T19:40:07+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':264C '-16264':8A,11A '-2026':7A,10A '/.':68C '2026':263C '29baa6f2cbfb2ef9907be7830505e33e82b5a1e6a45eb7f995022d09f5841f09':28C '4e81':229C 'activ':220C 'adjac':107C 'advertis':31C 'aiosendlett':4A,265C 'aiosendletter':12A 'amazon':26C 'amazon-inspector':25C 'archiv':42C,50C,55C,137C 'archive-and-upload':136C 'attack':224C 'author':73C 'author-control':72C 'base':267C 'bot':98C 'broaden':140C 'bug':36C 'call':120C 'caller':76C 'campaign':255C,262C,270C 'categori':252C 'chain':223C 'clear':257C 'cloudflar':62C 'code':2A,86C,185C,233C 'collect':102C,147C,203C 'comment':87C 'configur':61C 'confus':215C 'constitut':218C 'content':44C 'control':74C 'cover':191C 'cover-stori':190C 'credenti':106C 'credential-adjac':105C 'ctype':151C,156C,179C 'ctypes.windll.shell32.shellexecutew':121C 'data':103C,204C,251C 'declar':150C 'depend':155C,214C 'dependency-confus':213C 'descript':193C 'destin':70C,199C 'detail':17C 'directori':91C 'disabl':83C 'e3b63bbe719f6d0bdd42930bb2f3235b8e41cbacf449743bb7dca67c9f08':230C 'edit':20C 'elev':132C 'endpoint':64C 'escal':207C 'execut':180C 'exfiltr':235C,248C,273C 'expect':93C 'file':144C,236C,241C,272C 'files-exfiltr':271C 'folder':100C 'function':41C,119C 'goal':246C 'hardcod':58C,195C 'hide':232C 'host':198C 'includ':95C 'indic':88C 'infosteal':261C 'init':40C 'inspector':27C 'instal':112C,172C,187C,226C 'intent':259C 'interpret':129C 'joint':217C 'kam193':228C 'leav':110C 'librari':162C 'like':260C 'line':23C 'local':108C,202C 'localappdata':46C 'locally-collect':201C 'log':47C 'machin':114C 'mal':6A,9A 'malici':1A,13B,253C,258C 'modul':163C 'name':168C,212C 'non':60C 'non-configur':59C 'off-host':196C 'packag':14B,30C,174C,231C 'parti':183C 'per':15C 'perform':134C 'pip':165C 'post':52C 'privileg':206C 'publish':176C 'pypi':5A,170C 'pyproject.toml':149C 'python':159C 'reachabl':145C 'reason':266C 'redirect':81C 'relaunch':127C 'releas':238C 'report':37C 'resolv':166C 'result':54C 'reveal':244C 'runa':124C 'runtim':154C 'safe':35C 'sensit':249C 'separ':148C 'set':142C 'shutil.make':49C 'sourc':16C,24C,227C 'sparkling-pine-f202.stilluer-sweden.workers.dev':67C 'sparkling-pine-f202.stilluer-sweden.workers.dev/.':66C 'standard':161C 'standard-librari':160C 'state':109C 'stdlib':211C 'stdlib-nam':210C 'stori':192C 'suppli':222C 'supply-chain':221C 'target':90C,239C,274C 'telegram':97C,250C,275C 'third':182C 'time':188C 'token':99C 'uac':131C 'unclear':240C 'upload':139C 'vector':216C 'verb':125C 'way':79C 'whatev':173C 'window':116C 'worker':63C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-17T19:40:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16264","url":"https://osv.dev/vulnerability/MAL-2026-16264","severity":"critical","published_at":"2026-09-17T19:40:07+00:00","modified_at":"2026-09-22T23:30:07+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}