{"id":"MAL-2026-5329","kind":"package","aliases":["MAL-2026-5329"],"related":[],"title":"Malicious code in spaysdatarbx (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1bcaa4bf6f81efed82d35081ec059dfcd2f55e50b84f28d8b0ad4d8afe63089f)\nspaysdatarbx is a Windows infostealer disguised as a Roblox DataStore library. On `import spaysdata`, __init__.py invokes main_entry() (wrapped in try/except: pass to stay silent), which performs three malicious actions: (1) reads %USERPROFILE%/AppData/Local/Roblox/LocalStorage/robloxcookies.dat, DPAPI-decrypts it, and POSTs the plaintext Roblox session cookie to a hardcoded Discord webhook (https://discord.com/api/webhooks/1499336276762038292/...); (2) walks Discord, Chrome, Edge, Brave, Opera, Yandex, and Firefox profile directories, force-kills Discord with `taskkill /f /im Discord.exe` to release leveldb locks, AES-GCM-decrypts auth tokens with each browser's DPAPI master key, and POSTs every recovered token to the same webhook; (3) establishes persistence by copying itself to %APPDATA%\\MySystemUtility\\ and writing an HKCU\\...\\Run\\MyPythonAutostartApp registry value that re-launches the stealer at every login, hiding the console window via ShowWindow(GetConsoleWindow(), 0). The package's advertised purpose ('Библиотека для работы с DataStore в Roblox') is a decoy — no DataStore functionality exists in main.py, only the stealer. Any developer who installs and imports this package has their Roblox session and all browser-stored Discord tokens sent to the attacker, plus a persistent autostart entry for ongoing theft.\n\n## Source: kam193 (31b0b97326861aabb747f26e130a5dbda5ac78100fafbb3a3327b1981119e3a6)\nThe package exfiltrates Roblox cookies from the victim machine.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-06-spaysrbdata\n\n\nReasons (based on the campaign):\n\n\n - infostealer","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"spaysdatarbx","fixed":[],"affected":"= 0.1.3; = 0.1.5","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-06-08T13:43:18+00:00","first_seen_at":"2026-10-26T20:51:55+00:00","triaged_at":"2026-10-26T21:14:45+00:00","updated_at":"2026-10-26T21:14:45+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-06':243C '-2026':7A,10A '-5329':8A,11A '/api/webhooks/1499336276762038292/...);':82C '/appdata/local/roblox/localstorage/robloxcookies.dat':63C '/f':101C '/im':102C '0':163C '1':60C '1bcaa4bf6f81efed82d35081ec059dfcd2f55e50b84f28d8b0ad4d8afe63089f':28C '2':83C '2026':242C '3':130C '31b0b97326861aabb747f26e130a5dbda5ac78100fafbb3a3327b1981119e3a6':221C 'action':59C 'advertis':167C 'ae':109C 'aes-gcm-decrypt':108C 'amazon':26C 'amazon-inspector':25C 'appdata':137C 'attack':210C 'auth':112C 'autostart':214C 'base':246C 'brave':88C 'browser':116C,203C 'browser-stor':202C 'campaign':234C,241C,249C 'categori':231C 'chrome':86C 'clear':236C 'code':2A 'consol':158C 'cooki':74C,226C 'copi':134C 'datastor':38C,173C,180C 'decoy':178C 'decrypt':66C,111C 'detail':17C 'develop':189C 'directori':94C 'discord':78C,85C,98C,205C 'discord.com':81C 'discord.com/api/webhooks/1499336276762038292/...);':80C 'discord.exe':103C 'disguis':34C 'dpapi':65C,118C 'dpapi-decrypt':64C 'edg':87C 'edit':20C 'entri':47C,215C 'establish':131C 'everi':123C,154C 'exfiltr':224C 'exist':182C 'firefox':92C 'forc':96C 'force-kil':95C 'function':181C 'gcm':110C 'getconsolewindow':162C 'hardcod':77C 'hide':156C 'hkcu':142C 'import':41C,193C 'infosteal':33C,240C,250C 'init':43C 'inspector':27C 'instal':191C 'intent':238C 'invok':45C 'kam193':220C 'key':120C 'kill':97C 'launch':150C 'leveldb':106C 'librari':39C 'like':239C 'line':23C 'lock':107C 'login':155C 'machin':230C 'main':46C 'main.py':184C 'mal':6A,9A 'malici':1A,13B,58C,232C,237C 'master':119C 'mypythonautostartapp':144C 'mysystemutil':138C 'ongo':217C 'opera':89C 'packag':14B,165C,195C,223C 'pass':51C 'per':15C 'perform':56C 'persist':132C,213C 'plaintext':71C 'plus':211C 'post':69C,122C 'profil':93C 'purpos':168C 'py':44C 'pypi':5A 're':149C 're-launch':148C 'read':61C 'reason':245C 'recov':124C 'registri':145C 'releas':105C 'roblox':37C,72C,175C,198C,225C 'run':143C 'sent':207C 'session':73C,199C 'showwindow':161C 'silent':54C 'sourc':16C,24C,219C 'spaysdata':42C 'spaysdatarbx':4A,12A,29C 'spaysrbdata':244C 'stay':53C 'stealer':152C,187C 'store':204C 'taskkil':100C 'theft':218C 'three':57C 'token':113C,125C,206C 'try/except':50C 'userprofil':62C 'valu':146C 'via':160C 'victim':229C 'walk':84C 'webhook':79C,129C 'window':32C,159C 'wrap':48C 'write':140C 'yandex':90C 'библиотека':169C 'в':174C 'для':170C 'работы':171C 'с':172C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-08T13:43:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-5329","url":"https://osv.dev/vulnerability/MAL-2026-5329","severity":"critical","published_at":"2026-06-08T13:43:18+00:00","modified_at":"2026-08-27T13:45:13+00:00","first_seen_at":"2026-10-26T20:51:55+00:00","fetched_at":"2026-10-26T20:51:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}