{"id":"MAL-2026-17753","kind":"package","aliases":["MAL-2026-17753"],"related":[],"title":"Malicious code in media-manager5 (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b2598535fc7c58644f4dacb6b83f87a90823b8d1b84bc3357a6b2ae500342ba9)\nThe package advertises itself as a 'silent per-user wallpaper rotator for Windows' but ships wallpaper.py, a command-and-control client that connects to the hardcoded endpoint https://googleforum.pythonanywhere.com. On construction of MediaManager5(), the package writes a runner script to %LOCALAPPDATA%\\MediaManager5\\runner.py and registers a Windows Scheduled Task named 'MediaManager5' with /SC ONLOGON, so the agent is executed via pythonw at every user logon and re-invokes wallpaper.py on a 10-minute loop. The agent registers the host as username@hostname against /api/register and polls /api/client/<id>/poll for commands dispatched through a COMMAND_HANDLERS table that includes an 'exec' handler running arbitrary shell commands via subprocess.run(command, shell=True), plus list/upload/download/delete/rename handlers over arbitrary filesystem paths; handle_download base64-encodes file contents and returns them to the server via /api/client/<id>/result. The wallpaper framing in the package name, README, and docstrings does not match the shipped payload.\n\n## Source: kam193 (cb983aa5b7a424ffd813440bb47cefb9d43ed193c38456dd8acb299aafa3cd56)\nThe package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-agentaix\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - peristence-autorun\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n\n - rat\n\n\n - persistence\n\n\n - Downloads and executes a remote malicious script.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"media-manager5","fixed":[],"affected":"= 0.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-10T08:02:44+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","triaged_at":"2026-10-26T21:06:18+00:00","updated_at":"2026-10-26T21:06:18+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':221C '-17753':10A,13A '-2026':9A,12A '/api/client':121C,166C '/api/register':118C '/poll':122C '/result':167C '/sc':86C '10':106C '2026':220C 'advertis':35C 'agent':90C,110C 'agentaix':222C 'allow':194C 'amazon':30C 'amazon-inspector':29C 'arbitrari':137C,149C 'attack':196C 'autorun':233C 'b2598535fc7c58644f4dacb6b83f87a90823b8d1b84bc3357a6b2ae500342ba9':32C 'base':224C 'base64':155C 'base64-encodes':154C 'campaign':212C,219C,227C 'categori':209C 'cb983aa5b7a424ffd813440bb47cefb9d43ed193c38456dd8acb299aafa3cd56':186C 'clear':214C 'client':55C 'code':2A,203C,237C 'command':52C,124C,128C,139C,142C,241C 'command-and-control':51C 'connect':57C 'construct':64C 'contain':236C 'content':158C 'control':54C 'detail':21C 'dispatch':125C 'docstr':177C 'download':153C,255C 'edit':24C 'encod':156C 'endpoint':61C 'everi':96C 'exec':134C 'execut':92C,201C,239C,257C 'exfiltr':198C,230C 'file':157C,199C,229C 'files-exfiltr':228C 'filesystem':150C 'frame':170C 'googleforum.pythonanywhere.com':62C 'handl':152C 'handler':129C,135C,147C 'hardcod':60C 'host':113C 'hostnam':116C 'includ':132C 'infosteal':218C 'inspector':31C 'instal':189C 'intent':216C 'invok':102C 'job':192C 'kam193':185C 'like':217C 'limit':243C 'line':27C 'list/upload/download/delete/rename':146C 'localappdata':74C 'logon':98C 'loop':108C 'machin':208C,252C 'mal':8A,11A 'malici':1A,17B,210C,215C,260C 'manager5':6A,16A 'match':180C 'media':5A,15A 'media-manager5':4A,14A 'mediamanager5':66C,75C,84C 'minut':107C 'name':83C,174C 'onlogon':87C 'packag':18B,34C,68C,173C,188C,235C 'path':151C 'payload':183C 'per':19C,41C 'per-us':40C 'perist':232C 'peristence-autorun':231C 'persist':191C,254C 'plus':145C 'poll':120C 'probabl':242C 'pypi':7A 'pythonw':94C 'rat':253C 're':101C 're-invok':100C 'readm':175C 'reason':223C 'regist':78C,111C 'remot':202C,240C,259C 'return':160C 'rotat':44C 'run':136C 'runner':71C 'runner.py':76C 'schedul':81C 'script':72C,261C 'server':164C 'set':247C 'shell':138C,143C 'ship':48C,182C 'silent':39C 'sourc':20C,28C,184C 'specif':246C 'subprocess.run':141C 'tabl':130C 'task':82C 'true':144C 'user':42C,97C 'usernam':115C 'via':93C,140C,165C 'victim':206C,250C 'wallpap':43C,169C 'wallpaper.py':49C,103C 'window':46C,80C 'write':69C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-10T08:02:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17753","url":"https://osv.dev/vulnerability/MAL-2026-17753","severity":"critical","published_at":"2026-10-10T08:02:44+00:00","modified_at":"2026-10-15T09:30:03+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","fetched_at":"2026-10-26T20:51:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}