xyq-drama-skill

{"schema_version":"1.7.4","id":"MAL-2026-10681","published":"2026-07-15T14:29:25Z","modified":"2026-09-01T11:20:31.903208489Z","summary":"Malicious code in xyq-drama-skill (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (062ea591e5b995503deb15b174a37fc7af37cb5987a6c3d715d256fe0c3bfe10)\nsetup.py registers a custom install cmdclass that, on `pip install`, downloads an opaque binary from https://douyin-cloud.tos-cn-beijing.volces.com/obj/hosts/log-helper to ~/.log-helper, sets it executable, and spawns it detached via subprocess.Popen with start_new_session=True. There is no hash or signature verification, no version pinning, and the fetched binary is unrelated to the package's advertised purpose (a Chinese short-video drama script generator). The console_scripts entry `xyq-drama` provides a second execution trigger: ensure_helper() re-fetches the same URL to ~/.log-helper if absent, chmods it executable, and launches it (optionally under `setsid... -w`). The dropped file is named as a hidden dotfile (.log-helper) in $HOME and framed as a benign 'log helper', a naming choice that does not correspond to the package's declared functionality.\n\n## Source: kam193 (283e19b30723479c8d85b742514f7f6c4a4964a8b0e57ebb4239c3285c35188f)\nDuring installation and import, the package downloads and starts a malicious executable, which appears to be a COFFLoader beacon.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-07-xyq-drama-skill\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - malware\n","affected":[{"package":{"name":"xyq-drama-skill","ecosystem":"PyPI"},"versions":["0.1.0","0.2.0","0.3.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.py","sha256":"06663cfed7234c3b4899803c654b33f65850cd1569b8739302f5809c16ae4f81","tlsh":"e5313102dd26353481c341f1e83680636fa71907af12987174ef42594f8d839c07857d"},{"path":"xyq_drama_skill/_helper.py","sha256":"e93f5a6258036cf233118b4c35ef262ab26b3fce38133c1658faf93e5130fd42","tlsh":"5c11c085e1493820c1c346f2f81145b367db694beb475c35b5ee46d42f8e8ba80748bd"}],"package_integrity":[{"filename":"xyq_drama_skill-0.3.0-py3-none-any.whl","hashes":{"blake2b_256":"876233412dafd0294c5564651fe49c6da9d28eabcfdc9001389715ee76914a60","md5":"e038991370540b4ba5c99b760ed230b6","sha256":"7997181c3299ef13e8203f7df5b884f0bfecfc8ac424c5c903b71535f734f5f9"}},{"filename":"xyq_drama_skill-0.3.0.tar.gz","hashes":{"blake2b_256":"186bfc8809f79aa8febd914427c7fdbb1a01e51f1d3783a74ea1707b45be15fc","md5":"d72ada206bf77d2e4eb105289a9e75fe","sha256":"553f659cfc60773de2fa8d6a7519e47bfab44b52d0ccf85af8718b32c97daedd"}}]}}}],"references":[{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/cb5006f65df07c47a8cd1ec49b76e6f73b8ffca225fd0a9e47a60905cafeaaff/detection"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/xyq-drama-skill"},{"type":"PACKAGE","url":"https://pypi.org/project/xyq-drama-skill/0.3.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/xyq-drama-skill/0.2.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/xyq-drama-skill/0.1.0/"}],"database_specific":{"iocs":{"domains":["douyin-cloud.tos-cn-beijing.volces.com","s62fhr06buoa937godru4.apigateway-cn-beijing.volceapi.com"],"urls":["https://douyin-cloud.tos-cn-beijing.volces.com/obj/hosts/log-helper","https://s62fhr06buoa937godru4.apigateway-cn-beijing.volceapi.com:443/"]},"malicious-packages-origins":[{"id":"pypi/2026-07-xyq-drama-skill/xyq-drama-skill","import_time":"2026-07-15T15:34:32.997976025Z","modified_time":"2026-07-15T14:29:25.838819Z","sha256":"283e19b30723479c8d85b742514f7f6c4a4964a8b0e57ebb4239c3285c35188f","source":"kam193","versions":["0.1.0","0.2.0","0.3.0"]},{"id":"IN-MAL-2026-010680","import_time":"2026-07-15T16:34:36.088948723Z","modified_time":"2026-07-15T15:40:30Z","sha256":"062ea591e5b995503deb15b174a37fc7af37cb5987a6c3d715d256fe0c3bfe10","source":"amazon-inspector","versions":["0.3.0"]},{"id":"IN-MAL-2026-010681","import_time":"2026-07-15T16:34:36.156476425Z","modified_time":"2026-07-15T15:40:41Z","sha256":"1d7cac39df5db1d2f3c1448bf51ebafa397abf784550f983cb4ce1ce8a20b94f","source":"amazon-inspector","versions":["0.2.0"]},{"id":"IN-MAL-2026-010682","import_time":"2026-07-15T16:34:36.199882045Z","modified_time":"2026-07-15T15:40:50Z","sha256":"96b5d336aa2393ddd62d5d27be9185cefa73e01658584c85606811cbef6dfc7e","source":"amazon-inspector","versions":["0.1.0"]},{"id":"RLMA-2026-05659","import_time":"2026-09-01T11:17:14.681163077Z","modified_time":"2026-08-24T16:14:09Z","sha256":"0049695ca151623fc7484e68ca9de9786955888acd9b23e78bc6f5f7b918048f","source":"reversing-labs","versions":["0.2.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}