{"id":"MAL-2026-17422","kind":"package","aliases":["MAL-2026-17422"],"related":[],"title":"Malicious code in shortneer (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4960c121d2fbf6337d33df0c6a304f4f3e968d18c64614c323ac5f8389020bab)\nThe package ships a macOS arm64 Rust-compiled Python extension (_core.abi3.so) fronted by a thin wrapper lb.py. The only exposed Python function, shortname(), invokes two gibberish-named native entrypoints (_core.dphjx0rdhx0 and _core.ioluli0x0xthf) and swallows all exceptions with a silent print(''). The native binary embeds the hardcoded path 'Library/Application Support/Telegram Desktop/tdata' (the installer's Telegram Desktop session store on macOS), the archive name 'fghj.zip', and the destination 'https://api.telegram.org', alongside zip, AES, ChaCha20 and reqwest/rustls/hyper HTTP client code. This matches packaging the installer's live Telegram Desktop session directory and uploading it to a Telegram bot controlled by the author, which grants full takeover of the installer's Telegram account. The random-looking native export names and the blanket exception suppression serve to hide the behavior from casual inspection; the package's self-description as an OSINT utility does not match its actual data flow, which targets the installer's own messaging session store rather than any user-supplied target.\n\n## Source: kam193 (5e166ae1253c886885381cb5087f67a59a869cad6ece6f3ac40aefc6e463c27f)\nWhen used, the package exfiltrates Chrome extension files (likely targeting cryptocurrency wallets) and sensitive Telegram files.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-sherpy\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - exfiltration-crypto\n\n\n - target:telegram\n\n\n - native-extension","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"shortneer","fixed":[],"affected":"= 0.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-01T21:00:49+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':224C '-17422':8A,11A '-2026':7A,10A '2026':223C '4960c121d2fbf6337d33df0c6a304f4f3e968d18c64614c323ac5f8389020bab':28C '5e166':194C 'account':138C 'actual':173C 'ae':100C 'ae1253c886885381cb5087f67a59a869cad6ece6f3ac40aefc6e463c27f':195C 'alongsid':98C 'amazon':26C 'amazon-inspector':25C 'api.telegram.org':97C 'archiv':91C 'arm64':34C 'author':128C 'base':227C 'behavior':155C 'binari':73C 'blanket':148C 'bot':124C 'campaign':215C,222C,230C 'casual':157C 'categori':212C 'chacha20':101C 'chrome':201C 'clear':217C 'client':105C 'code':2A,106C 'compil':37C 'control':125C 'core.abi3.so':40C 'core.dphjx0rdhx0':60C 'core.ioluli0x0xthf':62C 'crypto':234C 'cryptocurr':206C 'data':174C 'descript':164C 'desktop':85C,115C 'desktop/tdata':80C 'destin':96C 'detail':17C 'directori':117C 'edit':20C 'emb':74C 'entrypoint':59C 'except':66C,149C 'exfiltr':200C,233C 'exfiltration-crypto':232C 'export':144C 'expos':49C 'extens':39C,202C,239C 'fghj.zip':93C 'file':203C,211C 'flow':175C 'front':41C 'full':131C 'function':51C 'gibberish':56C 'gibberish-nam':55C 'grant':130C 'hardcod':76C 'hide':153C 'http':104C 'infosteal':221C,231C 'inspect':158C 'inspector':27C 'instal':82C,111C,135C,179C 'intent':219C 'invok':53C 'kam193':193C 'lb.py':46C 'library/application':78C 'like':204C,220C 'line':23C 'live':113C 'look':142C 'maco':33C,89C 'mal':6A,9A 'malici':1A,13B,213C,218C 'match':108C,171C 'messag':182C 'name':57C,92C,145C 'nativ':58C,72C,143C,238C 'native-extens':237C 'osint':167C 'packag':14B,30C,109C,160C,199C 'path':77C 'per':15C 'print':70C 'pypi':5A 'python':38C,50C 'random':141C 'random-look':140C 'rather':185C 'reason':226C 'reqwest/rustls/hyper':103C 'rust':36C 'rust-compil':35C 'self':163C 'self-descript':162C 'sensit':209C 'serv':151C 'session':86C,116C,183C 'sherpi':225C 'ship':31C 'shortnam':52C 'shortneer':4A,12A 'silent':69C 'sourc':16C,24C,192C 'store':87C,184C 'suppli':190C 'support/telegram':79C 'suppress':150C 'swallow':64C 'takeov':132C 'target':177C,191C,205C,235C 'telegram':84C,114C,123C,137C,210C,236C 'thin':44C 'two':54C 'upload':119C 'use':197C 'user':189C 'user-suppli':188C 'util':168C 'wallet':207C 'wrapper':45C 'zip':99C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-01T21:00:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17422","url":"https://osv.dev/vulnerability/MAL-2026-17422","severity":"critical","published_at":"2026-10-01T21:00:49+00:00","modified_at":"2026-10-04T23:45:21+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","fetched_at":"2026-10-26T20:51:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}