{"id":"MAL-2026-19147","kind":"package","aliases":["MAL-2026-19147"],"related":[],"title":"Malicious code in aurum-pay (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e2b0d2ac6f807a70e04fe3dc30654e40995911bc11ccaec948674e44e243f392)\naurum_pay/__init__.py defines _boot_once(), invoked on the first SDK API call, which performs an HTTP GET to https://aurum-casino.com/sdk/ping?p=<os>&v=<ver>, reads the response body as a shell command string, and executes it on the host. On Linux/macOS the response is passed to `bash -c <resp> > /dev/null 2>&1 &` via subprocess.Popen (backgrounded, output suppressed). On Windows the response is passed to `powershell.exe -NoProfile -WindowStyle Hidden -Command Start-Job -ScriptBlock {<resp>}` with creationflags=0x08000000 (CREATE_NO_WINDOW). The code path is labeled with a comment framing it as 'SDK telemetry — report platform on first API call', but telemetry does not execute server-returned commands, and the hidden-window, no-profile, backgrounded, and output-suppressed execution flags are concealment features. The operator of aurum-casino.com can run arbitrary commands on any machine that imports and uses this package, giving full remote code execution against the installer.\n\n## Source: kam193 (40697f79120f5f6ad29a3fe7e3ef4b82f3264c7014b5b6f83e11cc0ccbae366f)\nWhen using the library, it silently executes remote commands and installs the next-stage payload. On linux, the payload is a binary. On Windows, it's own Python environment with the actual obfuscated payload attached to the image file. Finally, the payload ensures persistence and allows remote control and commands execution.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-aurum-pay\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - action-hidden-in-lib-usage\n\n\n - Downloads and executes a remote malicious script.\n\n\n - rat\n\n\n - persistence","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"aurum-pay","fixed":[],"affected":"= 1.2.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-11T20:24:40+00:00","first_seen_at":"2026-11-11T21:59:27+00:00","triaged_at":"2026-11-11T21:59:38+00:00","updated_at":"2026-11-11T22:01:51+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-11':247C '-19147':10A,13A '-2026':9A,12A '/dev/null':79C '/sdk/ping?p=':53C '0x08000000':105C '1':81C '2':80C '2026':246C '40697f79120f5f6ad29a3fe7e3ef4b82f3264c7014b5b6f83e11cc0ccbae366f':182C 'action':264C 'action-hidden-in-lib-usag':263C 'actual':215C 'allow':229C 'amazon':30C 'amazon-inspector':29C 'api':43C,126C 'arbitrari':161C 'attach':218C 'aurum':5A,15A,33C,249C 'aurum-casino.com':52C,158C 'aurum-casino.com/sdk/ping?p=':51C 'aurum-pay':4A,14A,248C 'background':84C,145C 'base':252C 'bash':77C 'binari':205C 'bodi':58C 'boot':36C 'c':78C 'call':44C,127C 'campaign':238C,245C,255C 'categori':235C 'clear':240C 'code':2A,110C,175C 'command':62C,98C,136C,162C,191C,233C 'comment':116C 'conceal':153C 'control':231C 'creat':106C 'creationflag':104C 'defin':35C 'detail':21C 'download':256C,269C 'e2b0d2ac6f807a70e04fe3dc30654e40995911bc11ccaec948674e44e243f392':32C 'edit':24C 'ensur':226C 'environ':212C 'execut':65C,132C,150C,176C,189C,234C,258C,261C,271C 'featur':154C 'file':222C 'final':223C 'first':41C,125C 'flag':151C 'frame':117C 'full':173C 'get':49C 'give':172C 'hidden':97C,140C,265C 'hidden-window':139C 'host':69C 'http':48C 'imag':221C 'import':167C 'infosteal':244C 'inspector':31C 'instal':179C,193C 'intent':242C 'invok':38C 'job':101C 'kam193':181C 'label':113C 'lib':267C 'librari':186C 'like':243C 'line':27C 'linux':200C 'linux/macos':71C 'machin':165C 'mal':8A,11A 'malici':1A,17B,236C,241C,274C 'next':196C 'next-stag':195C 'no-profil':142C 'noprofil':95C 'obfusc':216C,262C 'oper':156C 'output':85C,148C 'output-suppress':147C 'packag':18B,171C 'pass':75C,92C 'path':111C 'pay':6A,16A,250C 'pay/__init__.py':34C 'payload':198C,202C,217C,225C 'per':19C 'perform':46C 'persist':227C,277C 'platform':123C 'powershell.exe':94C 'profil':144C 'pypi':7A 'python':211C 'rat':276C 'read':55C 'reason':251C 'remot':174C,190C,230C,260C,273C 'report':122C 'respons':57C,73C,90C 'return':135C 'run':160C 'script':275C 'scriptblock':102C 'sdk':42C,120C 'server':134C 'server-return':133C 'shell':61C 'silent':188C 'sourc':20C,28C,180C 'stage':197C 'start':100C 'start-job':99C 'string':63C 'subprocess.popen':83C 'suppress':86C,149C 'telemetri':121C,129C 'usag':268C 'use':169C,184C 'v':54C 'via':82C 'window':88C,108C,141C,207C 'windowstyl':96C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["aurumpay"],"ptokens":["aurum","pay"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-19147':10A,13A '-2026':9A,12A 'aurum':5A,15A 'aurum-pay':4A,14A 'code':2A 'mal':8A,11A 'malici':1A 'pay':6A,16A 'pypi':7A","search_b":"'malici':17B 'packag':18B","search_c":"'-11':247C '/dev/null':79C '/sdk/ping?p=':53C '0x08000000':105C '1':81C '2':80C '2026':246C '40697f79120f5f6ad29a3fe7e3ef4b82f3264c7014b5b6f83e11cc0ccbae366f':182C 'action':264C 'action-hidden-in-lib-usag':263C 'actual':215C 'allow':229C 'amazon':30C 'amazon-inspector':29C 'api':43C,126C 'arbitrari':161C 'attach':218C 'aurum':33C,249C 'aurum-casino.com':52C,158C 'aurum-casino.com/sdk/ping?p=':51C 'aurum-pay':248C 'background':84C,145C 'base':252C 'bash':77C 'binari':205C 'bodi':58C 'boot':36C 'c':78C 'call':44C,127C 'campaign':238C,245C,255C 'categori':235C 'clear':240C 'code':110C,175C 'command':62C,98C,136C,162C,191C,233C 'comment':116C 'conceal':153C 'control':231C 'creat':106C 'creationflag':104C 'defin':35C 'detail':21C 'download':256C,269C 'e2b0d2ac6f807a70e04fe3dc30654e40995911bc11ccaec948674e44e243f392':32C 'edit':24C 'ensur':226C 'environ':212C 'execut':65C,132C,150C,176C,189C,234C,258C,261C,271C 'featur':154C 'file':222C 'final':223C 'first':41C,125C 'flag':151C 'frame':117C 'full':173C 'get':49C 'give':172C 'hidden':97C,140C,265C 'hidden-window':139C 'host':69C 'http':48C 'imag':221C 'import':167C 'infosteal':244C 'inspector':31C 'instal':179C,193C 'intent':242C 'invok':38C 'job':101C 'kam193':181C 'label':113C 'lib':267C 'librari':186C 'like':243C 'line':27C 'linux':200C 'linux/macos':71C 'machin':165C 'malici':236C,241C,274C 'next':196C 'next-stag':195C 'no-profil':142C 'noprofil':95C 'obfusc':216C,262C 'oper':156C 'output':85C,148C 'output-suppress':147C 'packag':171C 'pass':75C,92C 'path':111C 'pay':250C 'pay/__init__.py':34C 'payload':198C,202C,217C,225C 'per':19C 'perform':46C 'persist':227C,277C 'platform':123C 'powershell.exe':94C 'profil':144C 'python':211C 'rat':276C 'read':55C 'reason':251C 'remot':174C,190C,230C,260C,273C 'report':122C 'respons':57C,73C,90C 'return':135C 'run':160C 'script':275C 'scriptblock':102C 'sdk':42C,120C 'server':134C 'server-return':133C 'shell':61C 'silent':188C 'sourc':20C,28C,180C 'stage':197C 'start':100C 'start-job':99C 'string':63C 'subprocess.popen':83C 'suppress':86C,149C 'telemetri':121C,129C 'usag':268C 'use':169C,184C 'v':54C 'via':82C 'window':88C,108C,141C,207C 'windowstyl':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T20:24:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19147","url":"https://osv.dev/vulnerability/MAL-2026-19147","severity":"critical","published_at":"2026-11-11T20:24:40+00:00","modified_at":"2026-11-11T21:15:15+00:00","first_seen_at":"2026-11-11T21:59:27+00:00","fetched_at":"2026-11-11T21:59:27+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}