{"id":"MAL-2026-17192","kind":"package","aliases":["MAL-2026-17192"],"related":[],"title":"Malicious code in donutautosellsrc (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ef01bfa158639900e5ad9301eb32db37e7dab821e55ccff29574b905a8e5a2cb)\nsetup.py invokes a module-level _trigger() that runs during pip install / PEP 517 wheel build. The trigger calls donutautosellsrc.build.run(), which downloads https://thisisafalsepositive.st/cdn/v2/9f4e7a2c1b8d.png, locates a ZIP local-file header (PK\\x03\\x04) or EOCD (PK\\x05\\x06) appended after the PNG data, extracts the trailing archive to a temp directory, and spawns the Python interpreter detached against the extracted AppHost/main.py with a DAS_STAGED environment variable used as a reentry guard. All errors are swallowed to keep the operation silent. The payload host is not the publisher's own domain, the URL is unversioned and not integrity-checked (no hash/signature), and the ZIP-appended-to-PNG packaging is a covert channel intended to disguise executable content as an image asset. A source-comment in setup.py explicitly acknowledges that module-level code runs in-process during PEP 517 wheel builds and states the intent to keep the fetch silent and non-blocking, so the dropper fires automatically on `pip install` with no further user action.\n\n## Source: kam193 (c8af51da84b6b458a704ca222ba17f56d1158e0bfa52e0360aaeca4ae07c4cf8)\nDuring installation package fetches code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-donutautosellsrc\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - malware\n\n\n - native-extension\n\n\n - steganography\n\n\n - c2-in-blockchain\n\n\n - The package contains code to detect if it is running in a sandbox environment.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"donutautosellsrc","fixed":[],"affected":"= 0.3.7; = 0.3.8; = 0.3.9","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-27T00:09:55+00:00","first_seen_at":"2026-10-26T20:52:03+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':260C '-17192':8A,11A '-2026':7A,10A '/cdn/v2/9f4e7a2c1b8d.png,':53C '2026':259C '517':42C,173C 'acknowledg':161C 'action':201C 'amazon':26C 'amazon-inspector':25C 'append':69C,137C 'apphost/main.py':91C 'applic':217C 'archiv':77C 'asset':153C 'automat':193C 'base':263C 'block':188C 'blockchain':247C,283C 'build':44C,175C 'c2':238C,281C 'c2-in-blockchain':280C 'c8af51da84b6b458a704ca222ba17f56d1158e0bfa52e0360aaeca4ae07c4cf8':204C 'call':47C 'campaign':251C,258C,266C 'categori':248C 'channel':144C 'check':130C 'clear':253C 'code':2A,166C,209C,287C 'collect':230C 'comment':157C 'contain':214C,286C 'content':149C 'covert':143C 'das':94C 'data':73C,232C 'detach':87C 'detail':17C 'detect':289C 'directori':81C 'disguis':147C 'domain':121C 'donutautosellsrc':4A,12A,261C 'donutautosellsrc.build.run':48C 'download':50C,268C 'dropper':191C 'edit':20C 'ef01bfa158639900e5ad9301eb32db37e7dab821e55ccff29574b905a8e5a2cb':28C 'environ':96C,297C 'eocd':65C 'error':104C 'execut':148C,270C,273C 'exfiltr':234C 'explicit':160C 'extens':221C,278C 'extract':74C,90C 'fetch':183C,208C 'file':59C 'fire':192C 'guard':102C 'hash/signature':132C 'header':60C 'hidden':210C 'histori':243C 'hold':225C 'host':114C 'imag':152C,213C 'in-process':168C 'infosteal':228C,257C,267C 'inspector':27C 'instal':40C,196C,206C 'integr':129C 'integrity-check':128C 'intend':145C 'intent':179C,255C 'interpret':86C 'invok':30C 'kam193':203C 'keep':108C,181C 'level':34C,165C 'like':256C 'line':23C 'local':58C 'local-fil':57C 'locat':54C 'mal':6A,9A 'malici':1A,13B,249C,254C 'malwar':275C 'modul':33C,164C,222C,224C 'module-level':32C,163C 'nativ':220C,277C 'native-extens':276C 'non':187C 'non-block':186C 'obfusc':227C,274C 'oper':110C 'packag':14B,140C,207C,285C 'payload':113C 'pep':41C,172C 'per':15C 'pip':39C,195C 'pk':61C,66C 'png':72C,139C 'polygon':246C 'process':170C 'publish':118C 'pypi':5A 'python':85C,216C 'reason':262C 'reentri':101C 'remot':272C 'retriev':240C 'run':37C,167C,293C 'sandbox':296C 'sensit':231C 'server':239C 'setup.py':29C,159C 'silent':111C,184C 'sourc':16C,24C,156C,202C 'source-com':155C 'spawn':83C 'stage':95C 'state':177C 'steganographi':279C 'swallow':106C 'temp':80C 'thisisafalsepositive.st':52C 'thisisafalsepositive.st/cdn/v2/9f4e7a2c1b8d.png,':51C 'trail':76C 'transact':242C 'trigger':35C,46C 'unvers':125C 'url':123C 'use':98C 'user':200C 'variabl':97C 'wheel':43C,174C 'x03':62C 'x04':63C 'x05':67C 'x06':68C 'zip':56C,136C 'zip-appended-to-png':135C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-27T00:09:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17192","url":"https://osv.dev/vulnerability/MAL-2026-17192","severity":"critical","published_at":"2026-09-27T00:09:55+00:00","modified_at":"2026-10-25T23:45:03+00:00","first_seen_at":"2026-10-26T20:52:03+00:00","fetched_at":"2026-10-26T20:52:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}