{"id":"MAL-2026-5345","kind":"package","aliases":["MAL-2026-5345"],"related":[],"title":"Malicious code in dstill (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (698645f1cbbe41dbe7b65f3cf373ed38f59cb59ca9cc0bb25bd9d175114f1762)\nOn `import spaysdata`, __init__.py invokes main_entry() which executes a multi-stage Windows infostealer with no relation to the package's advertised purpose (a 'Roblox DataStore' library). Behaviors: (1) reads %USERPROFILE%\\AppData\\Local\\Roblox\\LocalStorage\\robloxcookies.dat, decrypts via CryptUnprotectData, and POSTs the plaintext cookies to a hardcoded Discord webhook (discord.com/api/webhooks/1513807955340820602/...) and a Google Apps Script endpoint (script.google.com/macros/s/AKfycbwa8sLEdsG_leFVecuc.../exec); (2) kills Discord processes via `taskkill /f /im Discord.exe`, then enumerates Discord/Discord Canary/PTB/Lightcord and ~20 Chromium browsers (Chrome, Edge, Brave, Yandex, Opera, Vivaldi,...) plus Firefox profiles, AES-GCM-decrypts tokens with each browser's DPAPI master key, validates them against the Discord API, and exfiltrates working tokens to the same endpoints; (3) installs persistence by copying itself to %LOCALAPPDATA%\\MicrosoftSecurityWorker\\WindowsSecurity.{pyw,exe}, registers that directory as a Windows Defender ExclusionPath via PowerShell `Add-MpPreference`, and creates a `schtasks /sc onlogon /rl highest` task named 'WindowsSecurityUpdate' to run at every logon. The Microsoft-lookalike paths/names are explicit AV evasion. Russian/Ukrainian comments in the source acknowledge the stealth and anti-AV intent. The pyproject description in Russian ('Библиотека для работы с DataStore в Roblox') is a lure targeting Roblox developers.\n\n## Source: kam193 (09fdc0fbdc8b1ba29a63f2807ec9c9af6dd1079a5ac6fa99c88b54df9bd22a0b)\nThe package exfiltrates Roblox cookies from the victim machine.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-06-spaysrbdata\n\n\nReasons (based on the campaign):\n\n\n - infostealer","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dstill","fixed":[],"affected":"= 0.3.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-06-09T10:15:49+00:00","first_seen_at":"2026-10-26T20:51:55+00:00","triaged_at":"2026-10-26T21:14:45+00:00","updated_at":"2026-10-26T21:14:45+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-06':249C '-2026':7A,10A '-5345':8A,11A '/api/webhooks/1513807955340820602/...)':82C '/f':98C '/im':99C '/macros/s/akfycbwa8sledsg_lefvecuc.../exec);':91C '/rl':175C '/sc':173C '09fdc0fbdc8b1ba29a63f2807ec9c9af6dd1079a5ac6fa99c88b54df9bd22a0b':227C '1':59C '2':92C '20':106C '2026':248C '3':144C '698645f1cbbe41dbe7b65f3cf373ed38f59cb59ca9cc0bb25bd9d175114f1762':28C 'acknowledg':199C 'add':167C 'add-mpprefer':166C 'advertis':52C 'ae':119C 'aes-gcm-decrypt':118C 'amazon':26C 'amazon-inspector':25C 'anti':204C 'anti-av':203C 'api':135C 'app':86C 'appdata':62C 'av':192C,205C 'base':252C 'behavior':58C 'brave':111C 'browser':108C,125C 'campaign':240C,247C,255C 'canary/ptb/lightcord':104C 'categori':237C 'chrome':109C 'chromium':107C 'clear':242C 'code':2A 'comment':195C 'cooki':74C,232C 'copi':148C 'creat':170C 'cryptunprotectdata':69C 'datastor':56C,216C 'decrypt':67C,121C 'defend':162C 'descript':209C 'detail':17C 'develop':224C 'directori':158C 'discord':78C,94C,134C 'discord.com':81C 'discord.com/api/webhooks/1513807955340820602/...)':80C 'discord.exe':100C 'discord/discord':103C 'dpapi':127C 'dstill':4A,12A 'edg':110C 'edit':20C 'endpoint':88C,143C 'entri':36C 'enumer':102C 'evas':193C 'everi':183C 'exclusionpath':163C 'exe':155C 'execut':38C 'exfiltr':137C,230C 'explicit':191C 'firefox':116C 'gcm':120C 'googl':85C 'hardcod':77C 'highest':176C 'import':30C 'infosteal':44C,246C,256C 'init':32C 'inspector':27C 'instal':145C 'intent':206C,244C 'invok':34C 'kam193':226C 'key':129C 'kill':93C 'librari':57C 'like':245C 'line':23C 'local':63C 'localappdata':151C 'localstorag':65C 'logon':184C 'lookalik':188C 'lure':221C 'machin':236C 'main':35C 'mal':6A,9A 'malici':1A,13B,238C,243C 'master':128C 'microsoft':187C 'microsoft-lookalik':186C 'microsoftsecuritywork':152C 'mpprefer':168C 'multi':41C 'multi-stag':40C 'name':178C 'onlogon':174C 'opera':113C 'packag':14B,50C,229C 'paths/names':189C 'per':15C 'persist':146C 'plaintext':73C 'plus':115C 'post':71C 'powershel':165C 'process':95C 'profil':117C 'purpos':53C 'py':33C 'pypi':5A 'pyproject':208C 'pyw':154C 'read':60C 'reason':251C 'regist':156C 'relat':47C 'roblox':55C,64C,218C,223C,231C 'robloxcookies.dat':66C 'run':181C 'russian':211C 'russian/ukrainian':194C 'schtask':172C 'script':87C 'script.google.com':90C 'script.google.com/macros/s/akfycbwa8sledsg_lefvecuc.../exec);':89C 'sourc':16C,24C,198C,225C 'spaysdata':31C 'spaysrbdata':250C 'stage':42C 'stealth':201C 'target':222C 'task':177C 'taskkil':97C 'token':122C,139C 'userprofil':61C 'valid':130C 'via':68C,96C,164C 'victim':235C 'vivaldi':114C 'webhook':79C 'window':43C,161C 'windowssecur':153C 'windowssecurityupd':179C 'work':138C 'yandex':112C 'библиотека':212C 'в':217C 'для':213C 'работы':214C 'с':215C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-09T10:15:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-5345","url":"https://osv.dev/vulnerability/MAL-2026-5345","severity":"critical","published_at":"2026-06-09T10:15:49+00:00","modified_at":"2026-08-27T13:45:13+00:00","first_seen_at":"2026-10-26T20:51:55+00:00","fetched_at":"2026-10-26T20:51:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}