telemetry-helper

{"modified":"2026-09-03T01:35:10Z","published":"2026-09-03T00:43:22Z","schema_version":"1.7.4","id":"MAL-2026-15829","summary":"Malicious code in telemetry-helper (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (26ef1779c00c37e2ee65632fefde6bbe242f5a15294ee018caa1d1d2ad5b6000)\nOn `import telemetry_helper`, top-level code starts a daemon thread that sleeps 30 seconds and then POSTs a JSON payload containing the hostname, username, current working directory, and the entire process environment (`dict(os.environ)`) to a hardcoded webhook.site inbox at https://webhook.site/e32d3b8a-a5df-40cc-ae60-7a8343b581e4. `os.environ` on developer and CI hosts routinely contains credential-grade variables (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, NPM_TOKEN, PYPI_TOKEN / TWINE_PASSWORD, database URLs, private keys), so this is a bulk credential and host-identity harvester. The destination is an anonymous third-party webhook inbox unrelated to any declared publisher, and the 30-second delay before the POST is consistent with evasion of short-lived install/import sandboxes. The behavior fires unconditionally at import with no opt-out and no relation to any advertised functionality.\n\n## Source: kam193 (f1bdc82cf3a04a5e654f400c53ec66cdbdd1c8ad0709c37eb653ab2eac4830db)\nIn this campaign, one package contains malicious code exfiltrating environment variables during import (telemetry-helper), and another one intentionally installs it as a dependency.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-telemetry-helper\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-env-variables\n\n\n - The malicious code is intentionally included in a dependency of the package\n","affected":[{"package":{"ecosystem":"PyPI","name":"telemetry-helper"},"versions":["1.0.1","2.0.0","1.1.0","1.0.0","1.0.2","1.2.0","1.3.0","2.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"telemetry_helper/__init__.py","sha256":"75112ad48c3d9a0510aadc61e6a17b1cd006c11724bf8cb062bc0f8701a79845","tlsh":"65f005d29ea820885745e7d81a2572642313fd1b2f117c24fc7c97301f8e20700f03b5"}],"package_integrity":[{"filename":"telemetry_helper-1.0.1-py3-none-any.whl","hashes":{"blake2b_256":"efafb965111adc1c0860fa50ae2f5366c41aae0ccc46c6c2ba2758f467a38637","md5":"d8f58d8fd7bb82dc25afa7d6cb38aa3c","sha256":"303cec7ac68de4030b1f10c40bb64300ddeba44255e2627a6fe6c39b8429448c"}},{"filename":"telemetry_helper-1.0.1.tar.gz","hashes":{"blake2b_256":"93bb56ff6d4d1ff234e60a45859bd3b9e986d111ea2d7f93dd7da0745270b417","md5":"695751bb965b3951188c92e4de5c30af","sha256":"cf379a3a5bc383ed96d669c468ff17272d060d8aecade58d35164543c9486d8a"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/telemetry-helper/1.0.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/telemetry-helper/2.0.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/telemetry-helper/1.1.0/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/telemetry-helper"},{"type":"PACKAGE","url":"https://pypi.org/project/telemetry-helper/1.0.2/"},{"type":"PACKAGE","url":"https://pypi.org/project/telemetry-helper/2.0.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/telemetry-helper/1.3.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/telemetry-helper/1.2.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/telemetry-helper/1.0.0/"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]}],"database_specific":{"iocs":{"domains":["real-router.duckdns.org"],"urls":["https://real-router.duckdns.org/collect"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-019356","import_time":"2026-09-03T01:33:33.320944394Z","modified_time":"2026-09-03T01:31:34Z","sha256":"26ef1779c00c37e2ee65632fefde6bbe242f5a15294ee018caa1d1d2ad5b6000","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-019359","import_time":"2026-09-03T01:33:33.577537578Z","modified_time":"2026-09-03T01:32:00Z","sha256":"9306ddc3944d54d3b469810fab5115bc570cf9378187e31adb5d40f324641a62","source":"amazon-inspector","versions":["2.0.0"]},{"id":"IN-MAL-2026-019360","import_time":"2026-09-03T01:33:33.732023255Z","modified_time":"2026-09-03T01:32:08Z","sha256":"bde8d8019a5c42631f81583549be7e8289adc08e1ecbc33f5c9189ad5a998cee","source":"amazon-inspector","versions":["1.1.0"]},{"id":"pypi/2026-09-telemetry-helper/telemetry-helper","import_time":"2026-09-03T01:33:35.71373856Z","modified_time":"2026-09-03T00:43:22.851497Z","sha256":"f1bdc82cf3a04a5e654f400c53ec66cdbdd1c8ad0709c37eb653ab2eac4830db","source":"kam193","versions":["1.0.0","1.0.1","1.0.2","1.1.0","1.2.0","1.3.0","2.0.0","2.0.1"]},{"id":"IN-MAL-2026-019355","import_time":"2026-09-03T01:33:33.134368071Z","modified_time":"2026-09-03T01:31:26Z","sha256":"39aade3885deec2e783f150f75c98b4e0277cb5b75bb75143db5e14d1b48a483","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-019357","import_time":"2026-09-03T01:33:33.406880282Z","modified_time":"2026-09-03T01:31:43Z","sha256":"4d4c31bb3d049c649bfd311ae9c2eacc467dc99fc5f9327af455a882c72daead","source":"amazon-inspector","versions":["2.0.1"]},{"id":"IN-MAL-2026-019358","import_time":"2026-09-03T01:33:33.511613246Z","modified_time":"2026-09-03T01:31:50Z","sha256":"5743abd7e4da41f524cf146db67e23cd811a7b6011dcf87ed5328de25177ed97","source":"amazon-inspector","versions":["1.3.0"]},{"id":"IN-MAL-2026-019361","import_time":"2026-09-03T01:33:33.783684189Z","modified_time":"2026-09-03T01:32:18Z","sha256":"703cb7e62c7717fb5215d65455554d0dffc2d9471b8c25ed5d446c989ce86953","source":"amazon-inspector","versions":["1.2.0"]},{"id":"IN-MAL-2026-019362","import_time":"2026-09-03T01:33:33.838073707Z","modified_time":"2026-09-03T01:32:25Z","sha256":"80946bf96b3cc2009e05cf4371b44db249858cfe78fdd7ff033862dd1a88ca44","source":"amazon-inspector","versions":["1.0.0"]}]}}