{"id":"MAL-2026-5334","kind":"package","aliases":["MAL-2026-5334"],"related":[],"title":"Malicious code in spaysrbx (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d4bae51ef6cd61eb9bfc38ac2d8dd8ad1f38d22c4e55b8ccdfc53cd2ed94076f)\nOn `import spaysdata`, the package's `__init__.py` invokes `main_entry()` in `spaysdata/main.py`, which performs three attacker-benefit actions automatically: (1) reads `%USERPROFILE%/AppData/Local/Roblox/LocalStorage/robloxcookies.dat`, decrypts it via `win32crypt.CryptUnprotectData`, and POSTs the cleartext Roblox session cookies to a hardcoded Discord webhook (`discord.com/api/webhooks/1513603677913616544/...`); (2) enumerates Discord, Discord Canary, Lightcord, Chrome, Edge, Brave, Yandex, Opera, and Firefox profile directories, decrypts dQw4w9WgXcQ-encrypted tokens using DPAPI + AES-GCM, kills `Discord.exe` via `taskkill`, and POSTs each token plus user info to the same webhook; (3) copies the running file to `%APPDATA%/MySystemUtility/` and writes `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MyPythonAutostartApp` to re-execute the stealer on each user login, with the console window hidden via `ShowWindow(0)`. The package's advertised purpose (`pyproject.toml` description: \"Library for working with DataStore in Roblox\") is a cover story — no DataStore functionality exists in the source; only credential-theft and persistence code is shipped.\n\n## Source: kam193 (21c6a7c2bf656df8e570edbe60daa7af52e1e0df0eae906de41f47dcf6eb0ede)\nThe package exfiltrates Roblox cookies from the victim machine.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-06-spaysrbdata\n\n\nReasons (based on the campaign):\n\n\n - infostealer","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"spaysrbx","fixed":[],"affected":"= 0.3.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-06-08T20:47:35+00:00","first_seen_at":"2026-10-26T20:51:55+00:00","triaged_at":"2026-10-26T21:14:45+00:00","updated_at":"2026-10-26T21:14:45+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-06':206C '-2026':7A,10A '-5334':8A,11A '/api/webhooks/1513603677913616544/...':72C '/appdata/local/roblox/localstorage/robloxcookies.dat':53C '/mysystemutility':120C '0':147C '1':50C '2':73C '2026':205C '21c6a7c2bf656df8e570edbe60daa7af52e1e0df0eae906de41f47dcf6eb0ede':184C '3':113C 'action':48C 'advertis':151C 'ae':96C 'aes-gcm':95C 'amazon':26C 'amazon-inspector':25C 'appdata':119C 'attack':46C 'attacker-benefit':45C 'automat':49C 'base':209C 'benefit':47C 'brave':81C 'campaign':197C,204C,212C 'canari':77C 'categori':194C 'chrome':79C 'clear':199C 'cleartext':61C 'code':2A,179C 'consol':142C 'cooki':64C,189C 'copi':114C 'cover':164C 'credenti':175C 'credential-theft':174C 'currentvers':127C 'd4bae51ef6cd61eb9bfc38ac2d8dd8ad1f38d22c4e55b8ccdfc53cd2ed94076f':28C 'datastor':159C,167C 'decrypt':54C,88C 'descript':154C 'detail':17C 'directori':87C 'discord':68C,75C,76C 'discord.com':71C 'discord.com/api/webhooks/1513603677913616544/...':70C 'discord.exe':99C 'dpapi':94C 'dqw4w9wgxcq':90C 'dqw4w9wgxcq-encrypted':89C 'edg':80C 'edit':20C 'encrypt':91C 'entri':39C 'enumer':74C 'execut':133C 'exfiltr':187C 'exist':169C 'file':117C 'firefox':85C 'function':168C 'gcm':97C 'hardcod':67C 'hidden':144C 'hkcu':123C 'import':30C 'info':108C 'infosteal':203C,213C 'init':35C 'inspector':27C 'intent':201C 'invok':37C 'kam193':183C 'kill':98C 'librari':155C 'lightcord':78C 'like':202C 'line':23C 'login':139C 'machin':193C 'main':38C 'mal':6A,9A 'malici':1A,13B,195C,200C 'microsoft':125C 'mypythonautostartapp':129C 'opera':83C 'packag':14B,33C,149C,186C 'per':15C 'perform':43C 'persist':178C 'plus':106C 'post':59C,103C 'profil':86C 'purpos':152C 'py':36C 'pypi':5A 'pyproject.toml':153C 're':132C 're-execut':131C 'read':51C 'reason':208C 'roblox':62C,161C,188C 'run':116C,128C 'session':63C 'ship':181C 'showwindow':146C 'softwar':124C 'sourc':16C,24C,172C,182C 'spaysdata':31C 'spaysdata/main.py':41C 'spaysrbdata':207C 'spaysrbx':4A,12A 'stealer':135C 'stori':165C 'taskkil':101C 'theft':176C 'three':44C 'token':92C,105C 'use':93C 'user':107C,138C 'userprofil':52C 'via':56C,100C,145C 'victim':192C 'webhook':69C,112C 'win32crypt.cryptunprotectdata':57C 'window':126C,143C 'work':157C 'write':122C 'yandex':82C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-08T20:47:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-5334","url":"https://osv.dev/vulnerability/MAL-2026-5334","severity":"critical","published_at":"2026-06-08T20:47:35+00:00","modified_at":"2026-08-27T13:45:13+00:00","first_seen_at":"2026-10-26T20:51:55+00:00","fetched_at":"2026-10-26T20:51:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}