{"id":"MAL-2026-16406","kind":"package","aliases":["MAL-2026-16406"],"related":[],"title":"Malicious code in crypto-trader-py (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (33e855a3ce62e35b613e702e710b81900769c241707c80f6a61462df0927529c)\nThe package presents itself as a crypto trading and backtesting toolkit, but ships no library code matching that description — SOURCES.txt lists only LICENSE, README, setup.py, and egg-info metadata, and top_level.txt is empty. setup.py unconditionally invokes _wus_boot() before setup() during `pip install`, which spawns a sibling script `_cryptotr_b2ca69.py` via subprocess.Popen using `pythonw.exe` with Windows creationflags 0x08000000 (CREATE_NO_WINDOW) to hide the console window, guarded by a tempdir lockfile (`13f8811c38.lk`) to avoid re-entry. Stealth markers (hidden-window flag, pythonw preference, silent try/except wrapping, obfuscated identifiers) and the absence of any advertised library content match a dropper cover-story pattern rather than a legitimate build step, and the child process runs on every install with no user interaction.\n\n## Source: kam193 (734dc70863cedc4f248265b79254d8bc4ac9dbbc40337ad7a5bbd45d9314500b)\nDuring installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-snap-queue\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"crypto-trader-py","fixed":[],"affected":"= 1.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-22T18:40:26+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':191C '-16406':11A,14A '-2026':10A,13A '0x08000000':93C '13f8811c38.lk':107C '2026':190C '33e855':34C '734dc70863cedc4f248265b79254d8bc4ac9dbbc40337ad7a5bbd45d9314500b':161C 'a3ce62e35b613e702e710b81900769c241707c80f6a61462df0927529c':35C 'absenc':128C 'advertis':131C 'amazon':32C 'amazon-inspector':31C 'analyz':172C 'attempt':166C 'avoid':109C 'backtest':45C 'base':196C 'boot':74C 'build':145C 'campaign':182C,189C,199C 'categori':179C 'child':149C 'clear':184C 'code':2A,51C,170C,211C 'command':205C 'consol':100C 'content':133C 'cover':138C 'cover-stori':137C 'creat':94C 'creationflag':92C 'crypto':5A,16A,42C 'crypto-trader-pi':4A 'crypto-trader-py':15A 'cryptotr_b2ca69.py':85C 'descript':54C 'detail':23C 'dropper':136C 'edit':26C 'egg':63C 'egg-info':62C 'empti':69C 'entri':112C 'everi':153C 'execut':169C,209C 'file':176C 'flag':118C 'guard':102C 'hidden':116C 'hidden-window':115C 'hide':98C 'identifi':125C 'info':64C 'infosteal':188C 'inspector':33C 'instal':79C,154C,163C,204C,213C 'intent':186C 'interact':158C 'invok':72C 'kam193':160C 'legitim':144C 'librari':50C,132C 'licens':58C 'like':187C 'line':29C 'list':56C 'lockfil':106C 'mal':9A,12A 'malici':1A,19B,180C,185C,210C 'marker':114C 'match':52C,134C 'metadata':65C 'miss':178C 'obfusc':124C 'overrid':202C 'packag':20B,37C,165C,201C 'pattern':140C 'payload':175C 'per':21C 'pip':78C 'prefer':120C 'present':38C 'process':150C 'py':7A,18A 'pypi':8A 'pythonw':119C 'pythonw.exe':89C 'queue':194C 'rather':141C 're':111C 're-entri':110C 'readm':59C 'reason':195C 'run':151C 'script':84C 'setup':76C 'setup.py':60C,70C,207C 'ship':48C 'sibl':83C 'silent':121C,168C 'snap':193C 'snap-queu':192C 'sourc':22C,30C,159C 'sources.txt':55C 'spawn':81C 'stealth':113C 'step':146C 'stori':139C 'subprocess.popen':87C 'tempdir':105C 'toolkit':46C 'top_level.txt':67C 'trade':43C 'trader':6A,17A 'try/except':122C 'uncondit':71C 'use':88C 'user':157C 'version':173C 'via':86C 'window':91C,96C,101C,117C 'wrap':123C 'wus':73C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-22T18:40:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16406","url":"https://osv.dev/vulnerability/MAL-2026-16406","severity":"critical","published_at":"2026-09-22T18:40:26+00:00","modified_at":"2026-09-22T22:30:05+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}