trongridi

{"schema_version":"1.7.4","id":"MAL-2026-15858","published":"2026-09-03T16:14:14Z","modified":"2026-09-04T00:47:46.484009624Z","summary":"Malicious code in trongridi (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7377339f830834c0b61f370dd642f368374d9551b8b51822d79a902b4b403103)\nThe package exposes a single public function perm(private_key) that POSTs the caller-supplied TRON wallet private key as JSON to the hardcoded endpoint https://reda-sequestered-justine.ngrok-free.dev/tron. The package name typosquats the legitimate trongrid TRON gateway, inducing callers to hand a wallet secret to this function. A second request to https://reda-sequestered-justine.ngrok-free.dev/switcher on the same ngrok tunnel returns a JSON value that gates the function's return, providing the operator with a remote control channel over the library's advertised behavior. Wallet private keys sent to this endpoint grant full control of the associated TRON funds.\n\n## Source: kam193 (3d03608cfdb32a163655abbfe15a2c86d5957fe498e678d3f6e3f44f12220454)\nPackage appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX (Tron / Tronix). Some packages additionally clone the readme of other, legit libraries. The similar packages are repeating uploaded to PyPI\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-04-tronix\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-generic\n\n\n - crypto-related\n","affected":[{"package":{"name":"trongridi","ecosystem":"PyPI"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"trongridi/main.py","sha256":"888e9bbd6807ce23eb79beb9d83d2cef96ca7987b6999f35c14842bcd9d606f2","tlsh":"e0f05ca318c17410c60a7135aeda3f06419a7c3f7a0c697033cd00a2df6636419f8120"}],"package_integrity":[{"filename":"trongridi-0.0.1-py3-none-any.whl","hashes":{"blake2b_256":"c95b4130886d6ba0c8da620c77abb3d7d264d10cb9cfdbc41d764f34fda19748","md5":"4c6cd5c426b6036090c8e74d924c78f4","sha256":"551f804c118c3ffbb2183208ac6c6a16a76391ce9831b2294f49e9f34acbed8e"}},{"filename":"trongridi-0.0.1.tar.gz","hashes":{"blake2b_256":"1958edcb6cf34614c3993960d1a80c753a9729fe6020b42c4a4992f2d298676b","md5":"cc17e598adf39cb45157e71366b4e22e","sha256":"e542fe55e66d6fd4431609efc77422eb6e5e8fc1aa8189a76c78bab661f29044"}}]}}}],"references":[{"type":"WEB","url":"https://en.wikipedia.org/wiki/Tron_(blockchain)"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/trongridi"},{"type":"PACKAGE","url":"https://pypi.org/project/trongridi/0.0.1/"}],"database_specific":{"iocs":{"domains":["68076f26e81df7060eba3e58.mockapi.io","66c0dc0bba6f27ca9a57c4bf.mockapi.io","67b9f37c51192bd378dee810.mockapi.io","reda-sequestered-justine.ngrok-free.dev"]},"malicious-packages-origins":[{"id":"pypi/2025-04-tronix/trongridi","import_time":"2026-09-03T16:40:52.345084007Z","modified_time":"2026-09-03T16:14:14.30473Z","sha256":"3d03608cfdb32a163655abbfe15a2c86d5957fe498e678d3f6e3f44f12220454","source":"kam193","versions":["0.0.1"]},{"id":"IN-MAL-2026-019379","import_time":"2026-09-04T00:45:54.383872351Z","modified_time":"2026-09-03T23:49:14Z","sha256":"7377339f830834c0b61f370dd642f368374d9551b8b51822d79a902b4b403103","source":"amazon-inspector","versions":["0.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}