python-walletlibr-v

{"modified":"2026-08-25T08:34:01Z","published":"2026-08-25T08:34:01Z","schema_version":"1.7.4","id":"MAL-2026-14488","summary":"Malicious code in python-walletlibr-v (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c)\npython-walletlibr-v is a wallet-lookalike PyPI package that ships no wallet functionality — only a stub hello() that prints 'Hello from my custom library!' and placeholder author metadata (__author__ = 'Your Name'). Its setup.py registers a CustomInstall command that, on Windows at pip install time, writes a.bat file into %TEMP%, spawns a new cmd.exe console to execute it via subprocess.Popen(['cmd.exe','/k', bat_path], CREATE_NEW_CONSOLE), and calls os.system('calc'). Arbitrary local command execution fires automatically during pip install on Windows hosts, unrelated to any advertised functionality.\n","affected":[{"package":{"ecosystem":"PyPI","name":"python-walletlibr-v"},"versions":["0.7.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.py","sha256":"d0b7ed3487fb76de391846693737f7cd9b1a385d967854c5ca111ea2c06f5126","tlsh":"6f2120028977097516b1036b0916cc06ffaea4a35775b28636fc4e349fba021060e93f"},{"path":"pycryptoshuffle/__init__.py","sha256":"a9eed37934c714a36a35e6adea50014e0fad2d323d1628b1d8e4a92bbaa2c134","tlsh":"25c09b450657155191dcc47f5500691179fd40b03fd55015573c311e79571555de524c"}],"package_integrity":[{"filename":"python_walletlibr_v-0.7.9.tar.gz","hashes":{"blake2b_256":"caf2051e75361d70d22f00732f27905e1223cb70ba0be6c6f831f8f191384905","md5":"16935464ca0bc132b702dccd08a04b5a","sha256":"7450765e50d74a4aed668e4159b58fa1b82a5d709bb6376fec84ed4776ecc6a5"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/python-walletlibr-v/0.7.9/"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018733","import_time":"2026-08-25T08:49:18.077188637Z","modified_time":"2026-08-25T08:34:01Z","sha256":"6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c","source":"amazon-inspector","versions":["0.7.9"]}]}}