{"id":"MAL-2026-18299","kind":"package","aliases":["MAL-2026-18299"],"related":[],"title":"Malicious code in claudeopuseni (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (715421a3b919f086db6ad4a57d6c8d6d333b019e3a63e607be95cf3fcb7aef5d)\nOn import, claudeopuseni/__init__.py invokes _boot.check(), which issues an HTTPS GET to https://thisisafalsepositive.st/cdn/v2/claudeopuseni/manifest.json, reads field 'r' as an encrypted blob (falling back to the base64-encoded _payload.PAYLOAD bundled in _payload.py when the host is unreachable), decrypts it with a ChaCha20+HMAC routine in security.unsign keyed from sha256(b'claudeopuseni.2026.channel.v1'), and passes the plaintext to builtins.exec via an attribute name assembled from chr(101,120,101,99) to hide the sink from static scanners. _boot gates detonation on the presence of a real user profile (USERPROFILE/HOME containing Documents or Downloads) and on absence of DAS_STAGED=1 or claudeopuseni_TELEMETRY=0, and caches a timestamp to suppress re-execution within 6 hours — a sandbox/CI evasion wrapper. The embedded fallback blob guarantees execution of attacker-controlled code even when the remote host is unavailable. The resulting code runs with the importing developer's privileges on any machine that imports the package in a normal user environment. The package name resembles the Anthropic Claude product family, consistent with a typosquat lure.\n\n## Source: kam193 (355cfc006ca4cb062c248bf2108be828c6164ae20d12ee5c7794ab68ee351843)\nDuring installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-donutautosellsrc\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - The package contains code to detect if it is running in a sandbox environment.\n\n\n - malware\n\n\n - native-extension\n\n\n - steganography\n\n\n - c2-in-blockchain","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"claudeopuseni","fixed":[],"affected":"= 0.1.0; = 0.1.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-25T23:43:00+00:00","first_seen_at":"2026-10-26T20:52:03+00:00","triaged_at":"2026-10-26T20:53:36+00:00","updated_at":"2026-10-26T21:05:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':264C '-18299':8A,11A '-2026':7A,10A '/cdn/v2/claudeopuseni/manifest.json,':42C '0':131C '1':127C '101':94C,96C '120':95C '2026':263C '355cfc006ca4cb062c248bf2108be828c6164ae20d12ee5c7794ab68ee351843':204C '6':142C '715421a3b919f086db6ad4a57d6c8d6d333b019e3a63e607be95cf3fcb7aef5d':28C '99':97C 'absenc':123C 'amazon':26C 'amazon-inspector':25C 'anthrop':193C 'applic':221C 'assembl':91C 'attack':156C 'attacker-control':155C 'attribut':89C 'b':78C 'back':51C 'base':267C 'base64':55C 'base64-encoded':54C 'blob':49C,151C 'blockchain':251C,301C 'boot':105C 'boot.check':33C 'builtins.exec':86C 'bundl':58C 'c2':242C,299C 'c2-in-blockchain':298C 'cach':133C 'campaign':255C,262C,270C 'categori':252C 'chacha20':70C 'chr':93C 'claud':194C 'claudeopuseni':4A,12A,129C 'claudeopuseni.2026.channel':79C 'claudeopuseni/__init__.py':31C 'clear':257C 'code':2A,158C,168C,208C,213C,282C 'collect':234C 'consist':197C 'contain':117C,218C,281C 'control':157C 'das':125C 'data':236C 'decrypt':66C 'detail':17C 'detect':284C 'deton':107C 'develop':173C 'document':118C 'donutautosellsrc':265C 'download':120C,272C 'edit':20C 'embed':149C 'encod':56C 'encrypt':48C 'environ':187C,292C 'evas':146C 'even':159C 'execut':140C,153C,274C,277C 'exfiltr':238C 'extens':225C,296C 'fall':50C 'fallback':150C 'famili':196C 'fetch':212C 'field':44C 'gate':106C 'get':38C 'guarante':152C 'hidden':214C 'hide':99C 'histori':247C 'hmac':71C 'hold':229C 'host':63C,163C 'hour':143C 'https':37C 'imag':217C 'import':30C,172C,180C 'infosteal':232C,261C,271C 'inspector':27C 'instal':206C 'intent':259C 'invok':32C 'issu':35C 'kam193':203C 'key':75C 'like':260C 'line':23C 'lure':201C 'machin':178C 'mal':6A,9A 'malici':1A,13B,253C,258C 'malwar':293C 'modul':226C,228C 'name':90C,190C 'nativ':224C,295C 'native-extens':294C 'normal':185C 'obfusc':207C,231C,278C 'packag':14B,182C,189C,280C 'pass':82C 'payload.payload':57C 'payload.py':60C 'per':15C 'plaintext':84C 'polygon':250C 'presenc':110C 'privileg':175C 'product':195C 'profil':115C 'pypi':5A 'python':220C 'r':45C 're':139C 're-execut':138C 'read':43C 'real':113C 'reason':266C 'remot':162C,276C 'resembl':191C 'result':167C 'retriev':244C 'routin':72C 'run':169C,288C 'sandbox':291C 'sandbox/ci':145C 'scanner':104C 'security.unsign':74C 'sensit':235C 'server':243C 'sha256':77C 'sink':101C 'sourc':16C,24C,202C 'stage':126C 'static':103C 'steganographi':297C 'suppress':137C 'telemetri':130C 'thisisafalsepositive.st':41C 'thisisafalsepositive.st/cdn/v2/claudeopuseni/manifest.json,':40C 'timestamp':135C 'transact':246C 'typosquat':200C 'unavail':165C 'unreach':65C 'use':210C 'user':114C,186C 'userprofile/home':116C 'v1':80C 'via':87C 'within':141C 'wrapper':147C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T23:43:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18299","url":"https://osv.dev/vulnerability/MAL-2026-18299","severity":"critical","published_at":"2026-10-25T23:43:00+00:00","modified_at":"2026-10-26T06:45:15+00:00","first_seen_at":"2026-10-26T20:52:03+00:00","fetched_at":"2026-10-26T20:52:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}