wacve-utils

{"schema_version":"1.7.4","id":"MAL-2026-11428","published":"2026-08-02T10:33:07Z","modified":"2026-08-04T21:35:15.620212407Z","summary":"Malicious code in wacve-utils (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4b2e59800b6fa0d3429fb7bccd34b4ae292dc2668919fba704a7b16ddff71071)\nOn `import wacve_utils`, the package's `__init__.py` unconditionally invokes `check_for_updates()`, which HTTP-fetches a hardcoded GitHub Gist under the user `Darknet-Hacker` (gist.githubusercontent.com/Darknet-Hacker/7f7e01a86e68403a457c4cd0c2d93f1d/raw/), base64-decodes the body, XORs it with a key derived from the string `wacve_utils`, zlib-decompresses it, `marshal.loads` a Python code object, and `exec`s it in-process. If the Gist fetch fails, the module falls back to shipped opaque blobs `config-linux.dat` / `config-termux.dat` (selected by a Termux/Linux platform branch) and runs them through the same base64+XOR+zlib+marshal decode-and-exec path. No pinning, no signature verification, and the payload is mutable by the Gist owner. The package advertises itself as `Lightweight utilities for chat application security checks` and exposes a stub `check_vulnerability` that returns a random boolean — a cover story unrelated to the executed payload. Importing this package grants the Gist owner arbitrary code execution in the installer's Python process.\n\n## Source: kam193 (de96a68d25555c9ee1792a22b84307ba3bc68d1e012bd841454dc775986260cb)\nThe package contains encrypted code with infostealers targeting Linux and Android (execution under Termux). The encrypted code collects files, browsers data, text messages and exfiltrates them to a Telegram channel.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-wacve-utils\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - exfiltration-browser-data\n\n\n - uses-telegram-bot\n\n\n - obfuscation\n\n\n - Downloads and executes a remote malicious script.\n\n\n - infostealer\n","affected":[{"package":{"name":"wacve-utils","ecosystem":"PyPI"},"versions":["1.0.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"wacve_utils/update_checker.py","sha256":"b9729eb9dca965290e6565140aa8a303bc3cc27bf3a84cdb72719fab22de7adc","tlsh":"6b514453c9ea0d22c343d954cc2792a6ab2f7e571a40a126fedc93588f0847cd0e23a9"},{"path":"setup.py","sha256":"6433ea7b27ee59bde6eed1fdca81f54b6c81f98a45003c0e2c27891d3a49859c","tlsh":"50e068d28a1996709581ad6a3aa530031978763f3ea0b4ed734401543bd91dfe7332ed"}],"package_integrity":[{"filename":"wacve_utils-1.0.7-py3-none-any.whl","hashes":{"blake2b_256":"0dd5a6bf0379ce450a54004200b5278723e0cf0da55f5675cc0d034c003541a6","md5":"2f3443bbcd0d2aba71e86f6f20a58c07","sha256":"36e8fa3e7b2a0ed040a86a834dc552d9e814e02d96f859654cab53c54fcb1f47"}},{"filename":"wacve_utils-1.0.7.tar.gz","hashes":{"blake2b_256":"c6658ffef826e9b364db8e0c4a70be674e2d685ffeb985658ab38faac5654adb","md5":"8c59ea0d8f8241860c6e1a7a0bd0a972","sha256":"b465fb49c2b33f4dc13364e2e5e9fcda355f2468c678a3118309a7bc8523547b"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/wacve-utils"},{"type":"PACKAGE","url":"https://pypi.org/project/wacve-utils/1.0.7/"}],"database_specific":{"iocs":{"urls":["https://gist.githubusercontent.com/Darknet-Hacker/7f7e01a86e68403a457c4cd0c2d93f1d/raw/"]},"malicious-packages-origins":[{"id":"pypi/2026-08-wacve-utils/wacve-utils","import_time":"2026-08-02T11:04:04.155614993Z","modified_time":"2026-08-02T10:33:07.923444Z","sha256":"de96a68d25555c9ee1792a22b84307ba3bc68d1e012bd841454dc775986260cb","source":"kam193","versions":["1.0.7"]},{"id":"pypi/2026-08-wacve-utils/wacve-utils","import_time":"2026-08-02T11:52:33.616443212Z","modified_time":"2026-08-02T10:33:07.923444Z","sha256":"24d4ada91d3bb23e5113caff835c4f285579f06da6ebe4153a456fb2627070f7","source":"kam193","versions":["1.0.7"]},{"id":"IN-MAL-2026-011047","import_time":"2026-08-04T21:33:15.008266033Z","modified_time":"2026-08-04T21:24:49Z","sha256":"4b2e59800b6fa0d3429fb7bccd34b4ae292dc2668919fba704a7b16ddff71071","source":"amazon-inspector","versions":["1.0.7"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"}]}