rasterkit

{"schema_version":"1.7.4","id":"MAL-2026-10974","published":"2026-07-21T06:01:48Z","modified":"2026-08-05T06:02:58.758825017Z","summary":"Malicious code in rasterkit (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (115c87298c4a239bd4954e39a155929c2480510343aefe1fa7c0b631b467af6b)\nThe rasterkit 1.0.2 distribution installs its modules under the top-level `PIL/` package name owned by Pillow. `top_level.txt` declares `PIL` and the wheel's RECORD places `PIL/__init__.py`, `PIL/Image.py`, `PIL/_binary.py`, and related files under this publisher's control, so an environment that installs rasterkit alongside or in place of Pillow will resolve `from PIL import Image` to code shipped by rasterkit. In addition, `PIL/_binary.py` defines a `bmp_plane_tail` function that walks the trailing pixels of a bundled 24-bpp bitmap at `PIL/_data/demo.bmp` (~2.3 MB), reads one byte per pixel, XORs each byte with a caller-supplied key, and returns the concatenated buffer optionally split into segments. `PIL/_data/__init__.py` hardcodes exact reconstruction parameters (`DEMO_TAIL_COUNT=5092`, `DEMO_TAIL_MIX=42`, `DEMO_TAIL_SEGMENTS=[3379,1713]`) that recover two specific hidden buffers from the bundled BMP. No code path in this version invokes the decoder at install or import time, and no `exec`/`compile`/`__import__` sink for the recovered bytes is present in the shipped files, so there is no traced auto-execution of the hidden payload. The combination — namespace occupation of Pillow's `PIL` plus a stego decoder with fixed parameters over a bundled carrier — matches the shape of a two-stage dropper staging component where a separate module would supply the execution sink.\n\n## Source: kam193 (a6eea31746baa37e55a76fec564eda1852839be005d53ae1e24bf2b9ea4c7875)\nThis package is a clone of Pillow library with malicious code hidden in an image using steganography. The code is the used in a dependant package to install an SSH backdoor.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-06-textwrap-toolkit-stager\n\n\nReasons (based on the campaign):\n\n\n - backdoor\n\n\n - obfuscation\n\n\n - crypto-related\n\n\n - Downloads and executes a remote malicious script.\n\n\n - exfiltration-crypto\n","affected":[{"package":{"name":"rasterkit","ecosystem":"PyPI"},"versions":["1.0.0","1.0.2","1.0.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"rasterkit-1.0.2.dist-info/top_level.txt","sha256":"ae266aae4fa1c99aa1e5fd59d19c228b774a7f112c07286ef5c53d20e0c5f8d6"},{"path":"PIL/_binary.py","sha256":"d9789ccd96ff3992518c04854b73aa48df3422ba00a326b602686160820b1647","tlsh":"3fa13096d821fad79b05806f8196e4193708f77733d0e2a87c9cad782f4681de9b52cc"}],"package_integrity":[{"filename":"rasterkit-1.0.2-py3-none-any.whl","hashes":{"blake2b_256":"ad082917528ba7498be33836657533b7e185d364812db1a205c06b3077855dbe","md5":"2379e6301d7f353c469cdbca7ae1c64a","sha256":"0163e7cd219763934c2bb5c0487faa26ba25f98b01c38c4e2e8d47b66fea985e"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/rasterkit"},{"type":"PACKAGE","url":"https://pypi.org/project/rasterkit/1.0.2/"},{"type":"PACKAGE","url":"https://pypi.org/project/rasterkit/1.0.4/"},{"type":"PACKAGE","url":"https://pypi.org/project/rasterkit/1.0.0/"}],"database_specific":{"iocs":{"ips":["194.5.152.9"],"urls":["http://194.5.152.9:5555/report","http://194.5.152.9:8080/hacks/textwrap-toolkit/textwrap_toolkit/__init__.py","http://194.5.152.9:5555/tao"]},"malicious-packages-origins":[{"id":"pypi/2026-06-textwrap-toolkit-stager/rasterkit","import_time":"2026-07-21T07:23:25.393717105Z","modified_time":"2026-07-21T06:01:48.065059Z","sha256":"a6eea31746baa37e55a76fec564eda1852839be005d53ae1e24bf2b9ea4c7875","source":"kam193","versions":["1.0.0","1.0.2","1.0.4"]},{"id":"IN-MAL-2026-012893","import_time":"2026-08-05T06:00:16.757286053Z","modified_time":"2026-08-05T05:04:25Z","sha256":"115c87298c4a239bd4954e39a155929c2480510343aefe1fa7c0b631b467af6b","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-012895","import_time":"2026-08-05T06:00:17.196099684Z","modified_time":"2026-08-05T05:04:41Z","sha256":"403e75910868428fd3630c92cc526be873a68fbbf7342f9ae22f98c558c44617","source":"amazon-inspector","versions":["1.0.4"]},{"id":"IN-MAL-2026-013139","import_time":"2026-08-05T06:00:46.386220512Z","modified_time":"2026-08-05T05:39:29Z","sha256":"f700fd4144468c1dd037694194a8e6de7dc414b1eb478bec2fb7545d69fea426","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}