kotoraka

{"schema_version":"1.7.4","id":"MAL-2026-13683","published":"2026-08-10T05:17:20Z","modified":"2026-08-10T11:53:52.276468290Z","summary":"Malicious code in kotoraka (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e0b7d2fa2d2e401d5ca6c2cc4bb07964a955afa5e532e3947fdcfd6395570dd6)\nOn import, kotoraka decodes base64-obfuscated filesystem paths pointing at the user's Monero wallet directory (Windows: C:\\Users\\<user>\\Documents\\Monero; Linux: /home/<user>/Monero), terminates any running `feather` or `monero` processes to release file locks, archives the wallet directory into a zip, and uploads it to the Telegram Bot API (api.telegram.org sendDocument) using a hardcoded bot token and chat_id (-5357046713). The Telegram bot token and target paths are stored as base64 literals decoded at runtime. The declared purpose of the package (an HTTP speed-up library) is unrelated to the actual behavior. The exfiltration fires as a top-level side effect of `import kotoraka`, with no user interaction.\n\n## Source: kam193 (e9ba78f7ee9a259fc6e518295fe3d0217c83808bbdf0fff2107883cb3cf50b3c)\nDuring import, the package exfiltrates cryptocurrency wallet files.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-kotanku\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-crypto\n\n\n - uses-telegram-bot\n","affected":[{"package":{"name":"kotoraka","ecosystem":"PyPI"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"kotoraka/__init__.py","sha256":"cc1a48d082ca55aaffffb8701f02fa9cb428231a6fc0a6384a3ed649f4006c7b","tlsh":"a151234ede6a440451b1938e2dc1d4f2c705336b6e10952f7ebc4a80afb08a6d272b7f"}],"package_integrity":[{"filename":"kotoraka-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"3c311eb7204d39c253bb80f9968b26acdc679f9010ff45d28018ebe7d22464ba","md5":"3a4176cfc7ad5c8917cfed004387fc8b","sha256":"42028ae09c4bf38af27cf1766fe8a99763e9c28b3afdf076bde88c36281ddad4"}},{"filename":"kotoraka-0.1.0.tar.gz","hashes":{"blake2b_256":"729390f522dd4f414fb34bd49e034394c54d8b7636744a2205f019e684be4ac5","md5":"49ca11c3ff4c6a48c862d3659844203d","sha256":"6c80cc17d4b02f39880cb931f3b88c2e773de06e58544c5efbafe0189cf0988a"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/kotoraka"},{"type":"PACKAGE","url":"https://pypi.org/project/kotoraka/0.1.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-08-kotanku/kotoraka","import_time":"2026-08-10T06:38:36.542628501Z","modified_time":"2026-08-10T05:17:20.394363Z","sha256":"e9ba78f7ee9a259fc6e518295fe3d0217c83808bbdf0fff2107883cb3cf50b3c","source":"kam193","versions":["0.1.0"]},{"id":"IN-MAL-2026-017211","import_time":"2026-08-10T11:51:55.247385759Z","modified_time":"2026-08-10T11:51:00Z","sha256":"e0b7d2fa2d2e401d5ca6c2cc4bb07964a955afa5e532e3947fdcfd6395570dd6","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}