{"id":"MAL-2026-17325","kind":"package","aliases":["MAL-2026-17325"],"related":[],"title":"Malicious code in cleanup-string (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (844c5afa9f00c02149f4f6314447c5738e04ed419014809c1df83f31aa012525)\nThe package advertises itself as a pure-Python string helper (strip, slugify, case conversion, whitespace collapse) and its README states the implementation is standard-library only. However, `cleanup_string/__init__.py` performs `from._impl import cleanup`, which loads a 1.3 MB Windows-only native extension `cleanup_string/_impl.cp313-win_amd64.vmp.pyd` (sha256 980ae204f04f9a7e68666670eb5b236bc7347d0111697df1015de665fd1a1712). The filename embeds the VMProtect convention `.vmp` and the binary matches that packer's signature: the only readable strings are Win32 API imports (LoadLibraryA, GetModuleHandleA, HeapAlloc, DisableThreadLibraryCalls, ExitProcess, KERNEL32.dll, VCRUNTIME140.dll) and the remaining ~1.3 MB is high-entropy virtualized code. VMProtect exists to defeat static and dynamic analysis; the trivial advertised functionality has no legitimate need for a virtualized native module. Any Windows Python 3.13 environment that imports `cleanup_string` executes this opaque, anti-analysis-protected code with the privileges of the importing process.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cleanup-string","fixed":[],"affected":"= 1.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-30T04:37:46+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-17325':10A,13A '-2026':9A,12A '1.3':71C,115C '3.13':147C '844c5afa9f00c02149f4f6314447c5738e04ed419014809c1df83f31aa012525':32C '980ae204f04f9a7e68666670eb5b236bc7347d0111697df1015de665fd1a1712':81C 'advertis':35C,133C 'amazon':30C 'amazon-inspector':29C 'analysi':130C,158C 'anti':157C 'anti-analysis-protect':156C 'api':103C 'binari':91C 'case':46C 'cleanup':5A,15A,62C,67C,78C,151C 'cleanup-str':4A 'cleanup-string':14A 'code':2A,122C,160C 'collaps':49C 'convent':87C 'convers':47C 'defeat':126C 'detail':21C 'disablethreadlibrarycal':108C 'dynam':129C 'edit':24C 'emb':84C 'entropi':120C 'environ':148C 'execut':153C 'exist':124C 'exitprocess':109C 'extens':77C 'filenam':83C 'from._impl':65C 'function':134C 'getmodulehandlea':106C 'heapalloc':107C 'helper':43C 'high':119C 'high-entropi':118C 'howev':61C 'implement':55C 'import':66C,104C,150C,166C 'inspector':31C 'kernel32.dll':110C 'legitim':137C 'librari':59C 'line':27C 'load':69C 'loadlibrarya':105C 'mal':8A,11A 'malici':1A,17B 'match':92C 'mb':72C,116C 'modul':143C 'nativ':76C,142C 'need':138C 'opaqu':155C 'packag':18B,34C 'packer':94C 'per':19C 'perform':64C 'privileg':163C 'process':167C 'protect':159C 'pure':40C 'pure-python':39C 'pypi':7A 'python':41C,146C 'readabl':99C 'readm':52C 'remain':114C 'sha256':80C 'signatur':96C 'slugifi':45C 'sourc':20C,28C 'standard':58C 'standard-librari':57C 'state':53C 'static':127C 'string':6A,16A,42C,100C,152C 'string/__init__.py':63C 'string/_impl.cp313-win_amd64.vmp.pyd':79C 'strip':44C 'trivial':132C 'vcruntime140.dll':111C 'virtual':121C,141C 'vmp':88C 'vmprotect':86C,123C 'whitespac':48C 'win32':102C 'window':74C,145C 'windows-on':73C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-30T04:37:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17325","url":"https://osv.dev/vulnerability/MAL-2026-17325","severity":"critical","published_at":"2026-09-30T04:37:46+00:00","modified_at":"2026-09-30T05:00:07+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","fetched_at":"2026-10-26T20:51:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}