{"id":"MAL-2026-18435","kind":"package","aliases":["MAL-2026-18435"],"related":[],"title":"Malicious code in privacypass-py (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0ca6e88317dac5ec524d2dc6ec4b2af7934e2213569ed7c8a757e59edb45b0c3)\nThe package presents itself as 'Privacy Pass client primitives' but ships no cryptographic functionality. Its only runtime effect is a data-exfiltration beacon. setup.py invokes a `_report()` routine during build/install that collects hostname, username, current working directory, argv, the parent process command line read from /proc/<ppid>/cmdline, and environment variable names and values matching credential-related prefixes (AWS_, GITHUB_, PIP_, and others), then POSTs the JSON payload to the hardcoded bare-IP endpoint http://85.190.112.236:8881/b/<nonce> over plain HTTP. privacypass_py/__init__.py repeats the same beacon at module top level, calling `_report('import')` on every `import privacypass_py` with an expanded prefix list (CLOUDFLARE_, SUPERTOKENS, HOME, USER, PATH) and an additional `secretish_names` list filtered by substrings KEY/SECRET/TOKEN/PASS/CRED/PRIVATE/SEED/MNEMONIC/SIGNATURE/COOKIE/SESSION/AUTH, sent to http://85.190.112.236:8881/f/<nonce>. The import-time path fires outside pip build isolation. The name and description function as cover for a package whose only shipped code is the beacon.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"privacypass-py","fixed":[],"affected":"= 0.1.101","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-01T08:01:23+00:00","first_seen_at":"2026-11-01T09:19:42+00:00","triaged_at":"2026-11-01T09:21:27+00:00","updated_at":"2026-11-01T09:27:37+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18435':10A,13A '-2026':9A,12A '/cmdline':80C '/proc':79C '0ca6e88317dac5ec524d2dc6ec4b2af7934e2213569ed7c8a757e59edb45b0c3':32C '85.190.112.236':109C,154C '8881/b':110C '8881/f':155C 'addit':144C 'amazon':30C 'amazon-inspector':29C 'argv':71C 'aw':92C 'bare':106C 'bare-ip':105C 'beacon':56C,119C,182C 'build':164C 'build/install':63C 'call':124C 'client':40C 'cloudflar':137C 'code':2A,179C 'collect':65C 'command':75C 'cover':172C 'credenti':89C 'credential-rel':88C 'cryptograph':45C 'current':68C 'data':54C 'data-exfiltr':53C 'descript':169C 'detail':21C 'directori':70C 'edit':24C 'effect':50C 'endpoint':108C 'environ':82C 'everi':128C 'exfiltr':55C 'expand':134C 'filter':148C 'fire':161C 'function':46C,170C 'github':93C 'hardcod':104C 'home':139C 'hostnam':66C 'http':113C 'import':126C,129C,158C 'import-tim':157C 'inspector':31C 'invok':58C 'ip':107C 'isol':165C 'json':100C 'key/secret/token/pass/cred/private/seed/mnemonic/signature/cookie/session/auth':151C 'level':123C 'line':27C,76C 'list':136C,147C 'mal':8A,11A 'malici':1A,17B 'match':87C 'modul':121C 'name':84C,146C,167C 'other':96C 'outsid':162C 'packag':18B,34C,175C 'parent':73C 'pass':39C 'path':141C,160C 'payload':101C 'per':19C 'pip':94C,163C 'plain':112C 'post':98C 'prefix':91C,135C 'present':35C 'primit':41C 'privaci':38C 'privacypass':5A,15A,114C,130C 'privacypass-pi':4A 'privacypass-py':14A 'process':74C 'py':6A,16A,131C 'py/__init__.py':115C 'pypi':7A 'read':77C 'relat':90C 'repeat':116C 'report':60C,125C 'routin':61C 'runtim':49C 'secretish':145C 'sent':152C 'setup.py':57C 'ship':43C,178C 'sourc':20C,28C 'substr':150C 'supertoken':138C 'time':159C 'top':122C 'user':140C 'usernam':67C 'valu':86C 'variabl':83C 'whose':176C 'work':69C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-11-01T08:01:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18435","url":"https://osv.dev/vulnerability/MAL-2026-18435","severity":"critical","published_at":"2026-11-01T08:01:23+00:00","modified_at":"2026-11-01T08:30:04+00:00","first_seen_at":"2026-11-01T09:19:42+00:00","fetched_at":"2026-11-01T10:20:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}