AURUM-PAY · MAL-2026-19147 · Package
UNINSTALL IT, ROTATE THE KEYS IT COULD READ
Not triaged yet. The sources’ own description is below.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Unknown from the sources.
Unknown from the sources.
-= Per source details. Do not edit below this line.=-
aurum_pay/init.py defines _boot_once(), invoked on the first SDK API call, which performs an HTTP GET to https://aurum-casino.com/sdk/ping?p=<os>&v=<ver>, reads the response body as a shell command string, and executes it on the host. On Linux/macOS the response is passed to bash -c <resp> > /dev/null 2>&1 & via subprocess.Popen (backgrounded, output suppressed). On Windows the response is passed to powershell.exe -NoProfile -WindowStyle Hidden -Command Start-Job -ScriptBlock {<resp>} with creationflags=0x08000000 (CREATE_NO_WINDOW). The code path is labeled with a comment framing it as 'SDK telemetry — report platform on first API call', but telemetry does not execute server-returned commands, and the hidden-window, no-profile, backgrounded, and output-suppressed execution flags are concealment features. The operator of aurum-casino.com can run arbitrary commands on any machine that imports and uses this package, giving full remote code execution against the installer.
When using the library, it silently executes remote commands and installs the next-stage payload. On linux, the payload is a binary. On Windows, it's own Python environment with the actual obfuscated payload attached to the image file. Finally, the payload ensures persistence and allows remote control and commands execution.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-aurum-pay
Reasons (based on the campaign):
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Downloads and executes a remote executable.
obfuscation
action-hidden-in-lib-usage
Downloads and executes a remote malicious script.
rat
persistence