{"id":"MAL-2026-17240","kind":"package","aliases":["MAL-2026-17240"],"related":[],"title":"Malicious code in aseitylab (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9b47f0f7a0776cad3d4c83604d35a0023a250d2f035e58129233095aa2b110a3)\naseitylab/_shimdata.py contains a large base85-encoded, zlib-compressed blob stored as DATA. aseitylab/compat.py defines _ensure_compat(), which base85-decodes and zlib-inflates DATA and passes the result to exec(compile(..., '<aseitylab-compat>', 'exec')). setup.py imports aseitylab.compat and invokes _ensure_compat() during package build/install, and aseitylab/__init__.py calls the same function on every import, so the decoded payload runs both when the package is installed and whenever it is imported. Execution is gated by environment variables (ASEITYLAB_COMPAT=0, DAS_STAGED=1) that allow the payload to be suppressed in build or test environments. The README advertises a pure-Python task-orchestration toolkit with no runtime dependencies, which does not require a compressed, encoded executable blob shipped as 'compatibility shim data'. MANIFEST.in additionally excludes file names (loader_payload.py, make_armed.py, armed.json, manifest.benign.json) consistent with a build harness that produces separate 'armed' and 'benign' tarballs. The contents of the executed payload are not inspectable from the shipped source; installing or importing the package hands arbitrary code execution to whatever DATA decodes to.\n\n## Source: kam193 (24b99c2059065cbe44f7dac2f1d2878b237c58150c0890baa1856852e76fcb24)\nDuring installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-donutautosellsrc\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - The package contains code to detect if it is running in a sandbox environment.\n\n\n - malware\n\n\n - native-extension\n\n\n - steganography\n\n\n - c2-in-blockchain","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"aseitylab","fixed":[],"affected":"= 0.1.0; = 0.1.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-28T21:24:44+00:00","first_seen_at":"2026-10-26T20:52:02+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':262C '-17240':8A,11A '-2026':7A,10A '0':107C '1':110C '2026':261C '24b99c2059065cbe44f7dac2f1d2878b237c58150c0890baa1856852e76fcb24':202C '9b47f0f7a0776cad3d4c83604d35a0023a250d2f035e58129233095aa2b110a3':28C 'addit':153C 'advertis':125C 'allow':112C 'amazon':26C 'amazon-inspector':25C 'applic':219C 'arbitrari':192C 'arm':169C 'armed.json':159C 'aseitylab':4A,12A,105C 'aseitylab.compat':66C 'aseitylab/__init__.py':75C 'aseitylab/_shimdata.py':29C 'aseitylab/compat.py':43C 'base':265C 'base85':34C,49C 'base85-decodes':48C 'base85-encoded':33C 'benign':171C 'blob':39C,146C 'blockchain':249C,299C 'build':119C,164C 'build/install':73C 'c2':240C,297C 'c2-in-blockchain':296C 'call':76C 'campaign':253C,260C,268C 'categori':250C 'clear':255C 'code':2A,193C,206C,211C,280C 'collect':232C 'compat':46C,70C,106C,149C 'compil':62C 'compress':38C,143C 'consist':161C 'contain':30C,216C,279C 'content':174C 'das':108C 'data':42C,55C,151C,197C,234C 'decod':50C,85C,198C 'defin':44C 'depend':137C 'detail':17C 'detect':282C 'donutautosellsrc':263C 'download':270C 'edit':20C 'encod':35C,144C 'ensur':45C,69C 'environ':103C,122C,290C 'everi':81C 'exclud':154C 'exec':61C,63C 'execut':99C,145C,177C,194C,272C,275C 'exfiltr':236C 'extens':223C,294C 'fetch':210C 'file':155C 'function':79C 'gate':101C 'hand':191C 'har':165C 'hidden':212C 'histori':245C 'hold':227C 'imag':215C 'import':65C,82C,98C,188C 'inflat':54C 'infosteal':230C,259C,269C 'inspect':181C 'inspector':27C 'instal':93C,186C,204C 'intent':257C 'invok':68C 'kam193':201C 'larg':32C 'like':258C 'line':23C 'loader_payload.py':157C 'make_armed.py':158C 'mal':6A,9A 'malici':1A,13B,251C,256C 'malwar':291C 'manifest.benign.json':160C 'manifest.in':152C 'modul':224C,226C 'name':156C 'nativ':222C,293C 'native-extens':292C 'obfusc':205C,229C,276C 'orchestr':132C 'packag':14B,72C,91C,190C,278C 'pass':57C 'payload':86C,114C,178C 'per':15C 'polygon':248C 'produc':167C 'pure':128C 'pure-python':127C 'pypi':5A 'python':129C,218C 'readm':124C 'reason':264C 'remot':274C 'requir':141C 'result':59C 'retriev':242C 'run':87C,286C 'runtim':136C 'sandbox':289C 'sensit':233C 'separ':168C 'server':241C 'setup.py':64C 'shim':150C 'ship':147C,184C 'sourc':16C,24C,185C,200C 'stage':109C 'steganographi':295C 'store':40C 'suppress':117C 'tarbal':172C 'task':131C 'task-orchestr':130C 'test':121C 'toolkit':133C 'transact':244C 'use':208C 'variabl':104C 'whatev':196C 'whenev':95C 'zlib':37C,53C 'zlib-compress':36C 'zlib-infl':52C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-28T21:24:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17240","url":"https://osv.dev/vulnerability/MAL-2026-17240","severity":"critical","published_at":"2026-09-28T21:24:44+00:00","modified_at":"2026-10-25T23:45:03+00:00","first_seen_at":"2026-10-26T20:52:02+00:00","fetched_at":"2026-10-26T20:52:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}