{"id":"MAL-2026-17752","kind":"package","aliases":["MAL-2026-17752"],"related":[],"title":"Malicious code in agentaix (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c403a9ecab78c519698c7faebcb0f9de4f8af059a4c3f5803acf8c534923138a)\nOn `import agentaix`, `src/agentaix/__init__.py` executes `drop_readme_on_desktop()` at module top level, copying the bundled file `readme.txt` to `~/Desktop/readme.txt`. The file is not documentation: it is a Python remote-access client with a `#!/usr/bin/env python3` shebang that registers `username@hostname` with a hardcoded command-and-control server at `https://googleforum.pythonanywhere.com` and polls `/api/client/<id>/...` for operator commands. Handlers implement arbitrary shell execution via `subprocess.run(command, shell=True)` (`handle_exec`), arbitrary file read with base64-encoded upload back to the C2 (`handle_download`), plus `upload`, `delete`, `rename`, and `open` operations. The dropper stages the payload under a benign filename in a highly visible location to induce the user to run it; once run, the operator obtains interactive shell and arbitrary file read on the host, enabling theft of SSH keys, cloud credentials, and other secrets. `pyproject.toml` ships placeholder author metadata (`Your Name` / `you@example.com`, `github.com/yourname/agentaix`), consistent with an unattributed malicious upload.\n\n## Source: kam193 (f42a135102abc5c66418237d4c6d9f8ee608570f8d4d5146463924666e0338e1)\nThe package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-agentaix\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - peristence-autorun\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n\n - rat\n\n\n - persistence\n\n\n - Downloads and executes a remote malicious script.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"agentaix","fixed":[],"affected":"= 0.1.0; = 0.2.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-10T07:57:16+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':219C '-17752':8A,11A '-2026':7A,10A '/api/client':83C '/desktop/readme.txt':48C '/usr/bin/env':64C '/yourname/agentaix':175C '2026':218C 'access':60C 'agentaix':4A,12A,31C,220C 'allow':192C 'amazon':26C 'amazon-inspector':25C 'arbitrari':89C,99C,149C 'attack':194C 'author':168C 'autorun':231C 'back':107C 'base':222C 'base64':104C 'base64-encoded':103C 'benign':127C 'bundl':44C 'c2':110C 'c403a9ecab78c519698c7faebcb0f9de4f8af059a4c3f5803acf8c534923138a':28C 'campaign':210C,217C,225C 'categori':207C 'clear':212C 'client':61C 'cloud':160C 'code':2A,201C,235C 'command':75C,86C,94C,239C 'command-and-control':74C 'consist':176C 'contain':234C 'control':77C 'copi':42C 'credenti':161C 'delet':115C 'desktop':37C 'detail':17C 'document':53C 'download':112C,253C 'drop':34C 'dropper':121C 'edit':20C 'enabl':155C 'encod':105C 'exec':98C 'execut':33C,91C,199C,237C,255C 'exfiltr':196C,228C 'f42a135102abc5c66418237d4c6d9f8ee608570f8d4d5146463924666e0338e1':184C 'file':45C,50C,100C,150C,197C,227C 'filenam':128C 'files-exfiltr':226C 'github.com':174C 'github.com/yourname/agentaix':173C 'googleforum.pythonanywhere.com':80C 'handl':97C,111C 'handler':87C 'hardcod':73C 'high':131C 'host':154C 'hostnam':70C 'implement':88C 'import':30C 'induc':135C 'infosteal':216C 'inspector':27C 'instal':187C 'intent':214C 'interact':146C 'job':190C 'kam193':183C 'key':159C 'level':41C 'like':215C 'limit':241C 'line':23C 'locat':133C 'machin':206C,250C 'mal':6A,9A 'malici':1A,13B,180C,208C,213C,258C 'metadata':169C 'modul':39C 'name':171C 'obtain':145C 'open':118C 'oper':85C,119C,144C 'packag':14B,186C,233C 'payload':124C 'per':15C 'perist':230C 'peristence-autorun':229C 'persist':189C,252C 'placehold':167C 'plus':113C 'poll':82C 'probabl':240C 'pypi':5A 'pyproject.toml':165C 'python':57C 'python3':65C 'rat':251C 'read':101C,151C 'readm':35C 'readme.txt':46C 'reason':221C 'regist':68C 'remot':59C,200C,238C,257C 'remote-access':58C 'renam':116C 'run':139C,142C 'script':259C 'secret':164C 'server':78C 'set':245C 'shebang':66C 'shell':90C,95C,147C 'ship':166C 'sourc':16C,24C,182C 'specif':244C 'src/agentaix/__init__.py':32C 'ssh':158C 'stage':122C 'subprocess.run':93C 'theft':156C 'top':40C 'true':96C 'unattribut':179C 'upload':106C,114C,181C 'user':137C 'usernam':69C 'via':92C 'victim':204C,248C 'visibl':132C 'you@example.com':172C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-10T07:57:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17752","url":"https://osv.dev/vulnerability/MAL-2026-17752","severity":"critical","published_at":"2026-10-10T07:57:16+00:00","modified_at":"2026-10-15T09:30:03+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","fetched_at":"2026-10-26T20:51:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}