{"id":"MAL-2026-17919","kind":"package","aliases":["MAL-2026-17919"],"related":[],"title":"Malicious code in ukraine69 (PyPI)","description":"Importing `ukraine69` in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local `.vault` files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts `account.deleteAccount` using GoyGram, with a Telethon fallback in versions 1.2.5–1.2.8. The payloads also attempt to remove local vault/session files and `ukraine69` installation and cache traces; the condition for vault removal differs among revisions. Versions 1.2.5–1.2.8 specifically target Hotaru session vault layouts, and 1.2.7–1.2.8 additionally try `auth.checkPassword` if a password is present in the vault. Version 1.2.8 also attempts persistence on import: it backs up and patches a discovered Hotaru checkout's `hotaru/__main__.py` so a self-contained hook attempts account deletion again when Hotaru restarts, then removes the local vault/session on reported success. Version 1.2.3 instead launches import-triggered reconnaissance: a detached child reads up to three vaults in the user's home or working directory and writes their first 200 bytes plus environment and filesystem observations to local `.u69_recon.log` files. No external exfiltration or account-deletion call appears in 1.2.3. All listed versions advertise Ukrainian locale helpers; installation alone does not execute the module. Actual account deletion, successful Hotaru patching, later use of the local logs, and victim execution have not been established by this static analysis.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4b8244951c9ae4f7baac94c3e7fd803e3c3ceaa27d64c2561cce098bd9dddf77)\nThe package's __init__.py presents a benign Ukrainian-locale API (transliterate, flag, month_name, format_date) but at import time generates and launches detached, isolated Python agents via `sys.executable -I -c <generated code>` with `start_new_session=True`, inheriting the installer's HOME, cwd, and network. The spawned agents glob the installer's filesystem (`~/.hotaru/**`, `~/.local/share/hotaru/**`, `~/**/*.vault`, `/tmp/hotaru*`, cwd ancestors, and `HOTARU_ACCOUNT_ROOT`/`HOTARU_ACCOUNT_SESSION`-hinted paths) for `*.vault` files, decrypt them via `goygram.security._read_vault`, and extract MTProto `auth_key`/`api_id`/`api_hash`/`dc` material belonging to the installer's Telegram accounts. Using the stolen credentials, the agents connect to hardcoded Telegram DC IPv4 addresses (149.154.175.53, 149.154.167.51, 149.154.175.100, 149.154.167.91, 91.108.56.130) and invoke `account.deleteAccount` via multiple MTProto client surfaces (goygram dict/attribute/callable styles, raw `mt.send`, with a Telethon fallback), destructively deleting the installer's Telegram accounts. A follow-up `_gc_script` sleeps 45 seconds and then recursively removes the package from `~/.cache/hotaru/module-deps/<id>/`, `~/.cache/pip/wheels`, `~/.cache/pip/http-v2`, `~/.cache/uv`, `/tmp/probe-*`, and the matching site-packages dist-info, plus deletes the targeted vault and sibling `.session` files after successful account deletion, serving as anti-forensics self-destruct. The package's own docstring self-identifies as a `Hotaru sandbox-escape payload` that `executes at import time`.\n\n## Source: kam193 (751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a)\nDuring import, package performs actions intended to escape sandbox, find Telegram-bot session files and initiate malicious account deletion.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-ukraine69\n\n\nReasons (based on the campaign):\n\n\n - destructive-actions\n\n\n - covering-tracks","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ukraine69","fixed":[],"affected":"= 1.2.0; = 1.2.1; = 1.2.2; = 1.2.3; = 1.2.5; = 1.2.6; = 1.2.7; = 1.2.8","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-17T16:53:55+00:00","first_seen_at":"2026-10-26T20:52:03+00:00","triaged_at":"2026-10-26T21:06:18+00:00","updated_at":"2026-10-26T21:06:18+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':491C '-17919':8A,11A '-2026':7A,10A '/.cache/hotaru/module-deps':401C '/.cache/pip/http-v2':403C '/.cache/pip/wheels':402C '/.cache/uv':404C '/.hotaru':301C '/.local/share/hotaru':302C '/tmp/hotaru':304C '/tmp/probe-':405C '1.2.0':19C '1.2.2':20C '1.2.3':147C,195C '1.2.5':22C,59C,85C '1.2.7':94C '1.2.8':23C,60C,86C,95C,108C '149.154.167.51':357C '149.154.167.91':359C '149.154.175.100':358C '149.154.175.53':356C '200':174C '2026':490C '45':392C '4b8244951c9ae4f7baac94c3e7fd803e3c3ceaa27d64c2561cce098bd9dddf77':246C '751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a':458C '91.108.56.130':360C 'account':132C,190C,211C,309C,312C,342C,384C,426C,477C 'account-delet':189C 'account.deleteaccount':50C,363C 'action':463C,500C 'actual':210C 'addit':96C 'address':355C 'advertis':199C 'agent':275C,295C,348C 'alon':204C 'also':63C,109C 'amazon':244C 'amazon-inspector':243C 'among':82C 'analysi':232C 'ancestor':306C 'anti':431C 'anti-forens':430C 'api':258C,330C,332C 'appear':193C 'attempt':49C,64C,110C,131C 'auth':328C 'auth.checkpassword':98C 'back':115C 'base':494C 'belong':336C 'benign':254C 'bot':471C 'byte':175C 'c':279C 'cach':74C 'call':192C 'campaign':482C,489C,497C 'categori':479C 'checkout':122C 'child':34C,48C,156C 'clear':484C 'client':367C 'code':2A 'condit':77C 'connect':349C 'contain':129C 'cover':502C 'covering-track':501C 'credenti':346C 'cwd':290C,305C 'date':264C 'dc':334C,353C 'decrypt':319C 'delet':133C,191C,212C,379C,416C,427C,478C 'destruct':378C,435C,499C 'destructive-act':498C 'detach':32C,155C,272C 'detail':235C 'dict/attribute/callable':370C 'differ':81C 'directori':169C 'discov':120C 'dist':413C 'dist-info':412C 'docstr':440C 'edit':238C 'environ':177C 'escap':449C,466C 'establish':228C 'execut':207C,224C,452C 'exfiltr':187C 'extern':186C 'extract':326C 'fallback':56C,377C 'field':46C 'file':28C,69C,184C,318C,423C,473C 'filesystem':179C,300C 'find':468C 'first':173C 'flag':260C 'follow':387C 'follow-up':386C 'forens':432C 'format':263C 'gc':389C 'generat':269C 'given':39C 'glob':296C 'goygram':52C,369C 'goygram.security':322C 'hardcod':351C 'hash':333C 'helper':202C 'hint':314C 'home':166C,289C 'hook':130C 'hotaru':89C,121C,136C,214C,308C,311C,446C 'hotaru/__main__.py':124C 'id':331C 'identifi':443C 'import':15C,113C,151C,267C,454C,460C 'import-trigg':150C 'info':414C 'infosteal':488C 'inherit':285C 'init':250C 'initi':475C 'inspector':245C 'instal':72C,203C,287C,298C,339C,381C 'instead':148C 'intend':464C 'intent':486C 'invok':362C 'ipv4':354C 'isol':273C 'kam193':457C 'key':329C 'later':216C 'launch':149C,271C 'layout':92C 'like':487C 'line':241C 'list':197C 'local':26C,67C,141C,182C,201C,220C,257C 'log':221C 'mal':6A,9A 'malici':1A,13B,476C,480C,485C 'match':408C 'materi':335C 'modul':209C 'month':261C 'mt.send':373C 'mtproto':327C,366C 'multipl':365C 'name':262C 'network':292C 'new':282C 'observ':180C 'packag':14B,248C,399C,411C,437C,461C 'password':101C 'patch':118C,215C 'path':315C 'payload':62C,450C 'per':233C 'perform':462C 'persist':111C 'plus':176C,415C 'present':103C,252C 'py':251C 'pypi':5A 'python':33C,274C 'raw':372C 'read':157C,323C 'reason':493C 'reconnaiss':153C 'recurs':396C 'remov':66C,80C,139C,397C 'report':144C 'restart':137C 'revis':83C 'root':310C 'sandbox':448C,467C 'sandbox-escap':447C 'script':390C 'search':24C 'second':393C 'self':128C,434C,442C 'self-contain':127C 'self-destruct':433C 'self-identifi':441C 'serv':428C 'session':45C,90C,283C,313C,422C,472C 'sibl':421C 'site':410C 'site-packag':409C 'sleep':391C 'sourc':234C,242C,456C 'spawn':294C 'specif':87C 'standard':37C 'start':30C,281C 'static':231C 'stolen':345C 'stream':38C 'style':371C 'success':145C,213C,425C 'suppress':36C 'surfac':368C 'sys.executable':277C 'target':88C,418C 'telegram':44C,341C,352C,383C,470C 'telegram-bot':469C 'telethon':55C,376C 'three':160C 'time':268C,455C 'trace':75C 'track':503C 'transliter':259C 'tri':97C 'trigger':152C 'true':284C 'u69_recon.log':183C 'ukraine69':4A,12A,16C,71C,492C 'ukrainian':200C,256C 'ukrainian-local':255C 'usabl':43C 'use':51C,217C,343C 'user':164C 'vault':27C,41C,79C,91C,106C,161C,303C,317C,324C,419C 'vault/session':68C,142C 'version':18C,58C,84C,107C,146C,198C 'via':276C,321C,364C 'victim':223C 'work':168C 'write':171C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T16:53:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17919","url":"https://osv.dev/vulnerability/MAL-2026-17919","severity":"critical","published_at":"2026-10-17T16:53:55+00:00","modified_at":"2026-10-26T06:45:16+00:00","first_seen_at":"2026-10-26T20:52:03+00:00","fetched_at":"2026-10-26T20:52:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}