rc4-secure

{"schema_version":"1.7.4","id":"MAL-2026-14306","published":"2026-08-19T20:31:43Z","modified":"2026-08-19T22:44:54.063067418Z","summary":"Malicious code in rc4-secure (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b7bcd1dcd28ea36c95e97448601f2414f34d53eabfc5452ec2471a316ebed97b)\nThe package presents itself as an RC4 encryption library but contains a hidden dropper reachable from its public API. RC4Cipher.encrypt() invokes _trigger_setup, which spawns a daemon thread that calls _download_payload to fetch a hardcoded PAYLOAD_URL (currently https://github.com/ip7z/7zip/releases/download/26.02/7z2602-x64.exe with a fallback to https://www.7-zip.org/a/7z2602-x64.exe) into a tempfile.NamedTemporaryFile(suffix='.exe'), then _execute_payload launches the binary detached via subprocess.Popen with DETACHED_PROCESS. Errors are silently swallowed. The behavior is undocumented in the README and unrelated to RC4. Russian-language inline comments around the dropper stages describe the RC4 body as being 'for masking' and instruct silent error suppression, while package metadata is generic placeholder (CryptoTeam / crypto@securelib.org / a nonexistent cryptoteam GitHub org). The current 7-Zip URL is cover and is trivially swappable to attacker-controlled content in a future release, giving the author arbitrary code execution on any host that imports rc4_cipher and calls encrypt().\n\n## Source: kam193 (c00d4194b32151e318678fb20166e9023d74acbed43e4a9d82f7834569cb73bd)\nPackage silently installs a remote executable in a way that is intentionally hidden from the user. During analysis, the code was downloading a legitimate software unrelated to provided functionality, suggesting it is a research-like demonstration.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-rc4-secure\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - modify-system-without-consent\n\n\n - action-hidden-in-lib-usage\n","affected":[{"package":{"name":"rc4-secure","ecosystem":"PyPI"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/rc4_cipher/core.py","sha256":"11b9ae2076048aba1a09a8e2e27031df5d0c199684717b250f68d1bdb7296ac2","tlsh":"cce19313ec627c884b529437c925d9027a57b43f57068b387cbc98282f96634caf9bdd"}],"package_integrity":[{"filename":"rc4_secure-1.0.0-py3-none-any.whl","hashes":{"blake2b_256":"eee0368db7c5301ace8ee05dcd66e053a324e0847d41fdeee22cd7a0221fda89","md5":"fe74bae050ce866d69ec996e7f0b3675","sha256":"8c6996cdbe7d396aae3b0b817aab708f5c13b9ea5837034210c5afe2df7ad541"}},{"filename":"rc4_secure-1.0.0.tar.gz","hashes":{"blake2b_256":"5af2266132c0e1f4042d3857d0731fa2d272e4a8e8162cdb861bc05d0d776e76","md5":"09669b75a9d410aa334b0c81ff13e4b7","sha256":"1ae8210f94cba6c45d396788bf2aac902be2a73767e152baf18a51eb9bd0697d"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/rc4-secure"},{"type":"PACKAGE","url":"https://pypi.org/project/rc4-secure/1.0.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-08-rc4-secure/rc4-secure","import_time":"2026-08-19T21:11:10.69035424Z","modified_time":"2026-08-19T20:31:43.055814Z","sha256":"c00d4194b32151e318678fb20166e9023d74acbed43e4a9d82f7834569cb73bd","source":"kam193","versions":["1.0.0"]},{"id":"IN-MAL-2026-018428","import_time":"2026-08-19T22:42:50.843064761Z","modified_time":"2026-08-19T22:21:31Z","sha256":"b7bcd1dcd28ea36c95e97448601f2414f34d53eabfc5452ec2471a316ebed97b","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}