Live › package › MAL-2026-17861
Go to dashboardNot triaged yet. The sources’ own description is below.
First seen by InfraStack 2026-10-26 20:51 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| sysdiagd | pypi | = 1.2.1; = 1.2.2; = 1.2.3 | – |
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
-= Per source details. Do not edit below this line.=-
Disguised as a system monitoring tool, the package delivers a Discord bot acting as an infostealer exfiltrating credentials, browser data, files and recording audio, screenshots and video. The code requires providing bot credentials, it is not functional without providing them.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-sysdiagd
Reasons (based on the campaign):
rat
exfiltration-browser-data
persistence
exfiltration-credentials
files-exfiltration
spyware-like
infostealer
This page as .md · .json · in your agent: get_signal("MAL-2026-17861")