{"id":"MAL-2026-18092","kind":"package","aliases":["MAL-2026-18092"],"related":[],"title":"Malicious code in test-workalendar-internal (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (06eccee3c04982c18f9f348949477e1540d3e63eab7ae66f5d851428d0308597)\ntest-workalendar-internal 0.0.3 ships a custom Hatchling build hook that runs during `pip install` (sdist/wheel build). The hook downloads two standalone binaries — ttyd from github.com/tsl0922/ttyd and cloudflared from github.com/cloudflare/cloudflared — to /tmp/ttyd and /tmp/cloudflared, chmods them executable, and spawns ttyd bound to 127.0.0.1:7681 serving an interactive `bash` shell protected only by a generated basic-auth user/password. It then launches `cloudflared tunnel --url http://127.0.0.1:7681`, parses the resulting `*.trycloudflare.com` URL from cloudflared's stdout, and POSTs a JSON payload containing the tunnel URL, username, and password to the hardcoded collector https://webhook.site/f03cbdbe-704b-4932-a0a7-847d749c19b6. The combined effect is a fully automatic install-time remote shell on the installer's host: a remote party receives the public tunnel URL and basic-auth credentials and can interact with bash on the installer's machine. The package's declared purpose (a weekday/calendar helper) is unrelated to web terminals or tunnels.\n\n## Source: kam193 (9f36e976d0fcf254def6da62e0090bfb2dbdf76176ed316655574408c25cb9a0)\nDuring build, the package creates a web-sharable terminal session and exposes it via a Cloudflare tunnel to the attacker.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-test-workalendar-internal\n\n\nReasons (based on the campaign):\n\n\n - backdoor\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"test-workalendar-internal","fixed":[],"affected":"= 0.0.1; = 0.0.2; = 0.0.3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T13:00:38+00:00","first_seen_at":"2026-10-26T20:52:00+00:00","triaged_at":"2026-10-26T21:02:03+00:00","updated_at":"2026-10-26T21:05:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':225C '-18092':11A,14A '-2026':10A,13A '/cloudflare/cloudflared':69C '/f03cbdbe-704b-4932-a0a7-847d749c19b6.':133C '/tmp/cloudflared':73C '/tmp/ttyd':71C '/tsl0922/ttyd':63C '0.0.3':39C '06eccee3c04982c18f9f348949477e1540d3e63eab7ae66f5d851428d0308597':34C '127.0.0.1':82C,104C '2026':224C '7681':83C,105C '9f36e976d0fcf254def6da62e0090bfb2dbdf76176ed316655574408c25cb9a0':191C 'amazon':32C 'amazon-inspector':31C 'attack':212C 'auth':96C,162C 'automat':140C 'backdoor':235C 'base':231C 'bash':87C,168C 'basic':95C,161C 'basic-auth':94C,160C 'binari':58C 'bound':80C 'build':44C,52C,193C 'campaign':216C,223C,234C 'categori':213C 'chmod':74C 'clear':218C 'cloudflar':65C,101C,112C,208C 'code':2A,247C 'collector':130C 'combin':135C 'command':241C 'contain':120C 'creat':196C 'credenti':163C 'custom':42C 'declar':177C 'detail':23C 'download':55C 'edit':26C 'effect':136C 'execut':76C,245C 'expos':204C 'fulli':139C 'generat':93C 'github.com':62C,68C 'github.com/cloudflare/cloudflared':67C 'github.com/tsl0922/ttyd':61C 'hardcod':129C 'hatchl':43C 'helper':181C 'hook':45C,54C 'host':150C 'infosteal':222C 'inspector':33C 'instal':50C,142C,148C,171C,240C,249C 'install-tim':141C 'intent':220C 'interact':86C,166C 'intern':7A,38C,229C 'internal':18A 'json':118C 'kam193':190C 'launch':100C 'like':221C 'line':29C 'machin':173C 'mal':9A,12A 'malici':1A,19B,214C,219C,246C 'overrid':238C 'packag':20B,175C,195C,237C 'pars':106C 'parti':153C 'password':126C 'payload':119C 'per':21C 'pip':49C 'post':116C 'protect':89C 'public':156C 'purpos':178C 'pypi':8A 'reason':230C 'receiv':154C 'remot':144C,152C 'result':108C 'run':47C 'sdist/wheel':51C 'serv':84C 'session':202C 'setup.py':243C 'sharabl':200C 'shell':88C,145C 'ship':40C 'sourc':22C,30C,189C 'spawn':78C 'standalon':57C 'stdout':114C 'termin':186C,201C 'test':5A,16A,36C,227C 'test-workalendar-intern':4A,35C,226C 'test-workalendar-internal':15A 'time':143C 'trycloudflare.com':109C 'ttyd':59C,79C 'tunnel':102C,122C,157C,188C,209C 'two':56C 'unrel':183C 'url':103C,110C,123C,158C 'user/password':97C 'usernam':124C 'via':206C 'web':185C,199C 'web-shar':198C 'webhook.site':132C 'webhook.site/f03cbdbe-704b-4932-a0a7-847d749c19b6.':131C 'weekday/calendar':180C 'workalendar':6A,17A,37C,228C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T13:00:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18092","url":"https://osv.dev/vulnerability/MAL-2026-18092","severity":"critical","published_at":"2026-10-20T13:00:38+00:00","modified_at":"2026-10-20T18:30:11+00:00","first_seen_at":"2026-10-26T20:52:00+00:00","fetched_at":"2026-10-26T20:52:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}