turbocalcng

{"modified":"2026-07-14T03:08:55Z","published":"2026-07-13T09:00:16Z","schema_version":"1.7.4","id":"MAL-2026-10441","summary":"Malicious code in turbocalcng (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (58f668de627f83b0348d681edd090804f202add609fdc9a3c671f987608fb448)\nturbocalcng/__init__.py imports arithmetic.py, which — beneath a facade of arithmetic helpers — contains an XOR-obfuscated in-memory native code execution path reachable at import time. A helper iReferringj(k,d) XOR-decodes byte lists into the strings 'base64', 'ctypes', 'mmap', 'threading', 'CFUNCTYPE', 'Thread', 'daemon', 'start', etc., and resolves them dynamically via getattr / __import__ / importlib.util.spec_from_file_location to hide the dangerous imports from static review. The reachable loader allocates an RWX region with mmap.mmap(-1, size, prot=7, flags=34), writes decoded bytes into it, casts the region's address through ctypes.CFUNCTYPE and invokes it inside a daemon threading.Thread — executing attacker-supplied native code in the installer's Python process on `import turbocalcng`. The obfuscation of core module names alongside the RWX + function-pointer-cast + thread-start primitive is characteristic of hostile shellcode injection, not any legitimate arithmetic functionality.\n\n## Source: kam193 (42db7e152a9be09d9e9dbd0db5242957ff335922fbc9cf430d406cff396a063f)\nDuring import an obfuscated code starts in-memory functions from a binary blob; after that, it communicates with dockfinancial[.]lu, the exact behaviour is unknown.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-07-turbocalc\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - other\n","affected":[{"package":{"ecosystem":"PyPI","name":"turbocalcng"},"versions":["0.1.0","0.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"turbocalcng-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"d32383254076cecfe83a1a2ad31ad41bd3d7e88f4870fb7fff36f34cdfb31a08","md5":"0bf3d3fc28155f9f64832b81944be1bb","sha256":"5c4da2179b66bfa628381a9ee02725240e85cc1cc983cfa2489e418c4f3441a4"}},{"filename":"turbocalcng-0.1.0.tar.gz","hashes":{"blake2b_256":"b4f3d46549e35624ec62095ea8dbce0e1d819e3fe58eee16a2b821d699896f43","md5":"71c2f7efc05ce47bf17755baa1cc9642","sha256":"351c616a6b6a43e2a457107725adc53c144c5b8caedafc4e185b5893bbe94b84"}}]}}}],"references":[{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/b763d1cb200d885985d0b592323ec8180817da4cc2117092176265d56723d44f/detection"},{"type":"EVIDENCE","url":"https://tria.ge/260710-tdnrmaex4s/behavioral1"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/turbocalcng"},{"type":"PACKAGE","url":"https://pypi.org/project/turbocalcng/0.1.0/"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]}],"database_specific":{"iocs":{"domains":["dockfinancial.lu"]},"malicious-packages-origins":[{"source":"kam193","sha256":"42db7e152a9be09d9e9dbd0db5242957ff335922fbc9cf430d406cff396a063f","import_time":"2026-07-13T10:37:41.546936583Z","id":"pypi/2026-07-turbocalc/turbocalcng","modified_time":"2026-07-13T09:40:53.974986Z","versions":["0.1.0","0.2.0"]},{"source":"amazon-inspector","sha256":"58f668de627f83b0348d681edd090804f202add609fdc9a3c671f987608fb448","import_time":"2026-07-14T03:07:05.650698477Z","id":"IN-MAL-2026-010359","modified_time":"2026-07-14T02:37:56Z","versions":["0.1.0"]}]}}