{"id":"MAL-2026-17861","kind":"package","aliases":["MAL-2026-17861"],"related":[],"title":"Malicious code in sysdiagd (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (0d396ad34176d29956d695014d261847ada859c184d7a8e7820d96087af7eafe)\nDisguised as a system monitoring tool, the package delivers a Discord bot acting as an infostealer exfiltrating credentials, browser data, files and recording audio, screenshots and video. The code requires providing bot credentials, it is not functional without providing them.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-sysdiagd\n\n\nReasons (based on the campaign):\n\n\n - rat\n\n\n - exfiltration-browser-data\n\n\n - persistence\n\n\n - exfiltration-credentials\n\n\n - files-exfiltration\n\n\n - spyware-like\n\n\n - infostealer","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sysdiagd","fixed":[],"affected":"= 1.2.1; = 1.2.2; = 1.2.3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-13T18:40:17+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","triaged_at":"2026-10-26T21:06:18+00:00","updated_at":"2026-10-26T21:06:18+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':79C '-17861':8A,11A '-2026':7A,10A '0d396ad34176d29956d695014d261847ada859c184d7a8e7820d96087af7eafe':26C '2026':78C 'act':39C 'audio':50C 'base':82C 'bot':38C,58C 'browser':45C,89C 'campaign':70C,77C,85C 'categori':67C 'clear':72C 'code':2A,55C 'credenti':44C,59C,94C 'data':46C,90C 'deliv':35C 'detail':17C 'discord':37C 'disguis':27C 'edit':20C 'exfiltr':43C,88C,93C,97C 'exfiltration-browser-data':87C 'exfiltration-credenti':92C 'file':47C,96C 'files-exfiltr':95C 'function':63C 'infosteal':42C,76C,101C 'intent':74C 'kam193':25C 'like':75C,100C 'line':23C 'mal':6A,9A 'malici':1A,13B,68C,73C 'monitor':31C 'packag':14B,34C 'per':15C 'persist':91C 'provid':57C,65C 'pypi':5A 'rat':86C 'reason':81C 'record':49C 'requir':56C 'screenshot':51C 'sourc':16C,24C 'spywar':99C 'spyware-lik':98C 'sysdiagd':4A,12A,80C 'system':30C 'tool':32C 'video':53C 'without':64C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-13T18:40:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17861","url":"https://osv.dev/vulnerability/MAL-2026-17861","severity":"critical","published_at":"2026-10-13T18:40:17+00:00","modified_at":"2026-10-13T19:00:05+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","fetched_at":"2026-10-26T20:51:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}