{"id":"MAL-2026-16346","kind":"package","aliases":["MAL-2026-16346"],"related":[],"title":"Malicious code in rrs (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (78c488c5d20c788e88c2d4f0a0cb1eb03317bc71edb05964adad62241fd1295e)\nOn launch of the `rrs` CLI, a background thread captures a full-screen screenshot via `mss` and POSTs the image together with hostname, username, OS/release, local IP, and timestamp to a hardcoded Discord webhook at https://discord.com/api/webhooks/1549807268294303860/... The upload runs unconditionally at startup, with no consent prompt and no user-configurable destination; the webhook is controlled by the package author and is not disclosed as a destination for screen contents. Separately, `Network.start` opens an MQTT connection to the public broker `broker.hivemq.com:1883` and publishes a JSON identity record (id, hostname, username, os) to the shared topic `rrs/v1/presence` every 5 seconds, exposing installer host and user identifiers to any subscriber of that world-readable topic. Screen contents typically include private data, credentials, tokens, and messages visible on the desktop at the moment of capture.\n\n## Source: kam193 (68c88bf30122de71b155310172fb01864659adaf9cc53c576695a82e2ff95d0d)\nThe package automatically and silently exfiltrates screenshots to a hardcoded location.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-rrs\n\n\nReasons (based on the campaign):\n\n\n - spyware-like\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"rrs","fixed":[],"affected":"= 0.4.105; = 0.3.100; = 0.4.106; = 0.4.103; = 0.4.102; = 0.4.104; = 0.3.5; = 0.1.0; = 0.1.3; = 0.1.4; = 0.1.5; = 0.1.7; = 0.1.8; = 0.2.0; = 0.2.1; = 0.2.2; = 0.3.101; = 0.4.107; = 0.4.108; = 0.4.109","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-21T03:46:09+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':191C '-16346':8A,11A '-2026':7A,10A '/api/webhooks/1549807268294303860/...':67C '2026':190C '5':129C '68c88bf30122de71b155310172fb01864659adaf9cc53c576695a82e2ff95d0d':167C '78c488c5d20c788e88c2d4f0a0cb1eb03317bc71edb05964adad62241fd1295e':28C 'amazon':26C 'amazon-inspector':25C 'author':91C 'automat':170C 'background':36C 'base':194C 'basic':207C 'broker':111C 'broker.hivemq.com:1883':112C 'campaign':182C,189C,197C 'captur':38C,164C 'categori':179C 'clear':184C 'cli':34C 'code':2A,204C 'configur':82C 'connect':107C 'consent':76C 'contain':203C 'content':101C,147C 'control':87C 'credenti':152C 'data':151C,208C 'desktop':159C 'destin':83C,98C 'detail':17C 'disclos':95C 'discord':62C 'discord.com':66C 'discord.com/api/webhooks/1549807268294303860/...':65C 'edit':20C 'everi':128C 'exfiltr':173C,206C 'expos':131C 'full':41C 'full-screen':40C 'hardcod':61C,177C 'host':133C 'hostnam':52C,120C 'id':119C 'ident':117C 'identifi':136C 'imag':49C 'includ':149C 'infosteal':188C 'inspector':27C 'instal':132C 'intent':186C 'ip':56C,213C 'json':116C 'kam193':166C 'launch':30C 'like':187C,200C,212C 'limit':219C 'line':23C 'local':55C 'locat':178C 'mal':6A,9A 'malici':1A,13B,180C,185C 'messag':155C 'moment':162C 'mqtt':106C 'mss':45C 'network.start':103C 'open':104C 'os':122C 'os/release':54C 'packag':14B,90C,169C,202C 'per':15C 'post':47C 'privat':150C 'prompt':77C 'public':110C 'publish':114C 'pypi':5A 'readabl':144C 'reason':193C 'record':118C 'risk':220C 'rrs':4A,12A,33C,192C 'rrs/v1/presence':127C 'run':70C 'screen':42C,100C,146C 'screenshot':43C,174C 'second':130C 'separ':102C 'share':125C 'silent':172C 'sourc':16C,24C,165C 'spywar':199C 'spyware-lik':198C 'startup':73C 'subscrib':139C 'system':211C 'thread':37C 'timestamp':58C 'togeth':50C 'token':153C 'topic':126C,145C 'typic':148C 'uncondit':71C 'upload':69C 'user':81C,135C 'user-configur':80C 'usernam':53C,121C,215C 'via':44C 'visibl':156C 'webhook':63C,85C 'world':143C 'world-read':142C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-21T03:46:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16346","url":"https://osv.dev/vulnerability/MAL-2026-16346","severity":"critical","published_at":"2026-09-21T03:46:09+00:00","modified_at":"2026-09-23T05:00:10+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","fetched_at":"2026-10-26T20:51:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}