---
id: "MAL-2026-17921"
kind: "package"
aliases: ["MAL-2026-17921"]
title: "Malicious code in leakdeep (PyPI)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "leakdeep", "fixed": [], "affected": "= 2.6.4; = 2.5.0; = 2.6.6; = 2.5.2; = 2.6.0; = 2.4.1; = 2.4.5; = 2.6.2; = 3.0.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-10-18T01:45:23+00:00"
first_seen_at: "2026-10-26T20:51:59+00:00"
updated_at: "2026-10-26T21:06:18+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-17921", "first_seen_at": "2026-10-26T20:51:59+00:00"}]
---

# Malicious code in leakdeep (PyPI)

## Affected

- pypi:leakdeep affected = 2.6.4; = 2.5.0; = 2.6.6; = 2.5.2; = 2.6.0; = 2.4.1; = 2.4.5; = 2.6.2; = 3.0.0 fixed ?

## Timeline

- 2026-10-26T20:51:59+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-17921

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (c0818f9da5e7dc1413ff1b2a24d3cb53d0b49d06bd802502296d6d8e8e536fee)
The package presents itself as an OSINT / credential-leak intelligence framework with a search CLI, but the advertised SearchEngine.search is a stub returning an empty list. Every invocation of the CLI (cli.main) unconditionally starts a background thread via SystemInfo.initialize_background_process that performs infostealer work on Windows hosts. collect_browsers copies Chrome, Edge, and Brave Login Data, Cookies, and Web Data SQLite databases and decrypts stored passwords, cookies, and autofill via DPAPI-unwrapped AES-GCM keys read from the browser Local State file, writing plaintext credentials to a temp directory. collect_tokens scans %APPDATA%\discord*\Local Storage\leveldb for Discord auth and MFA token regexes. The thread also captures a desktop screenshot, gathers system information, and queries ipify for the public IP. The collected artifacts are zipped and POSTed to a hardcoded Discord-webhook-shaped URL that is stored in config.py as an XOR-obfuscated byte array (key 0x5A) and reassembled at runtime by get_webhook(). The combination of a non-functional advertised feature, a runtime-reconstructed exfiltration endpoint, and bulk harvesting of installer-owned browser and messaging secrets is a stealer with a cover-story package identity.

## Source: kam193 (3ae583980c54e7c45aa4d33b3be917b307a323f0d213baadabe962268c08bb13)
When using the provided command, the code exfiltrates multiple data (browser credentials, cryptowallets, etc.), clipboard content, screenshots and webcam frames.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-10-leakdeep


Reasons (based on the campaign):


 - infostealer


 - exfiltration-browser-data


 - exfiltration-crypto


 - spyware-like


 - exfiltration-credentials


 - action-hidden-in-lib-usage


 - clipboard-stealing

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_