rrs

{"schema_version":"1.7.4","id":"MAL-2026-16346","published":"2026-09-21T03:46:09Z","modified":"2026-09-23T04:46:32.492858915Z","summary":"Malicious code in rrs (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (78c488c5d20c788e88c2d4f0a0cb1eb03317bc71edb05964adad62241fd1295e)\nOn launch of the `rrs` CLI, a background thread captures a full-screen screenshot via `mss` and POSTs the image together with hostname, username, OS/release, local IP, and timestamp to a hardcoded Discord webhook at https://discord.com/api/webhooks/1549807268294303860/... The upload runs unconditionally at startup, with no consent prompt and no user-configurable destination; the webhook is controlled by the package author and is not disclosed as a destination for screen contents. Separately, `Network.start` opens an MQTT connection to the public broker `broker.hivemq.com:1883` and publishes a JSON identity record (id, hostname, username, os) to the shared topic `rrs/v1/presence` every 5 seconds, exposing installer host and user identifiers to any subscriber of that world-readable topic. Screen contents typically include private data, credentials, tokens, and messages visible on the desktop at the moment of capture.\n\n## Source: kam193 (68c88bf30122de71b155310172fb01864659adaf9cc53c576695a82e2ff95d0d)\nThe package automatically and silently exfiltrates screenshots to a hardcoded location.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-rrs\n\n\nReasons (based on the campaign):\n\n\n - spyware-like\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n","affected":[{"package":{"name":"rrs","ecosystem":"PyPI"},"versions":["0.4.105","0.3.100","0.4.106","0.4.103","0.4.102","0.4.104","0.3.5","0.1.0","0.1.3","0.1.4","0.1.5","0.1.7","0.1.8","0.2.0","0.2.1","0.2.2","0.3.101","0.4.107","0.4.108","0.4.109"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"rrs/capture.py","sha256":"d5a4ea8f7fc93d1eb5f9c58fa7d4fc1f494a06876e0a574d346cd77f2cf07a1b","tlsh":"76415556eca69424eb31d09d9c8280d4f32262076f13c82ab8fc93646fb503795f93ad"}],"package_integrity":[{"filename":"rrs-0.4.105-py3-none-any.whl","hashes":{"blake2b_256":"06edda319c5a03e4e764ad9fb8b4cdf18a43d81b83a28c4e6871ed65b562e667","md5":"f34c2222601039d977009e4e38d7e971","sha256":"683d0c4f7dc37a19a0356acf176de90cfc65338ed8d1edaf6823d5ca60696daf"}},{"filename":"rrs-0.4.105.tar.gz","hashes":{"blake2b_256":"cb00f992411c6757c7f442f587e68f902aace67a3f4aa7bd92fcb1bcb5668558","md5":"21e3ca5a19ba6107fb130178b83f1673","sha256":"fa223c677fad6e5915e2bfe4543f47bcedae038249a6ac6ca6d725358b36844e"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.4.105/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.3.100/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.4.106/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.4.103/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.4.102/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.4.104/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.3.5/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/rrs"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.4.107/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.4.108/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.4.109/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.2.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.1.7/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.1.4/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.1.5/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.1.3/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.2.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.1.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.2.2/"},{"type":"PACKAGE","url":"https://pypi.org/project/rrs/0.1.8/"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020249","import_time":"2026-09-21T03:46:39.723374662Z","modified_time":"2026-09-21T03:46:26Z","sha256":"62e995ca8e187fe49bf109637cc941f48881c9153c8ab765b1164ce59f4f56c7","source":"amazon-inspector","versions":["0.4.105"]},{"id":"IN-MAL-2026-020247","import_time":"2026-09-21T03:46:39.566991418Z","modified_time":"2026-09-21T03:46:09Z","sha256":"6a50f48efdaf7b00c6eb72e8e16b36f02d5d2a3882ee01ca200ea3f7148cdca7","source":"amazon-inspector","versions":["0.3.100"]},{"id":"IN-MAL-2026-020248","import_time":"2026-09-21T03:46:39.64490915Z","modified_time":"2026-09-21T03:46:18Z","sha256":"e141895039e15529e461a314485cf94a3cbbf1cdbbec0905056151b46fc29a88","source":"amazon-inspector","versions":["0.4.106"]},{"id":"IN-MAL-2026-020251","import_time":"2026-09-21T04:22:50.234648104Z","modified_time":"2026-09-21T03:46:45Z","sha256":"ae5e88bd115804eb2f024dc489cc4f9ee3771fe371d0b7c86a0da9ce8a351216","source":"amazon-inspector","versions":["0.4.103"]},{"id":"IN-MAL-2026-020250","import_time":"2026-09-21T04:22:50.155508348Z","modified_time":"2026-09-21T03:46:34Z","sha256":"2775726e3be7b7ac9969bb742b49e7ae834fe7330c760d7f33382a9919041d36","source":"amazon-inspector","versions":["0.4.102"]},{"id":"IN-MAL-2026-020253","import_time":"2026-09-21T04:22:50.326353333Z","modified_time":"2026-09-21T03:47:03Z","sha256":"78c488c5d20c788e88c2d4f0a0cb1eb03317bc71edb05964adad62241fd1295e","source":"amazon-inspector","versions":["0.4.104"]},{"id":"IN-MAL-2026-020252","import_time":"2026-09-21T04:22:50.26384751Z","modified_time":"2026-09-21T03:46:54Z","sha256":"8943e0a536a21825c4247f4515edbd473faff733939034bfd30b5563ba6da35b","source":"amazon-inspector","versions":["0.3.5"]},{"id":"pypi/2026-09-rrs/rrs","import_time":"2026-09-21T09:25:21.682413817Z","modified_time":"2026-09-21T08:45:31.383777Z","sha256":"68c88bf30122de71b155310172fb01864659adaf9cc53c576695a82e2ff95d0d","source":"kam193","versions":["0.1.0","0.1.3","0.1.4","0.1.5","0.1.7","0.1.8","0.2.0","0.2.1","0.2.2","0.3.5","0.3.100","0.3.101","0.4.102","0.4.103","0.4.104","0.4.105","0.4.106","0.4.107","0.4.108","0.4.109"]},{"id":"IN-MAL-2026-020254","import_time":"2026-09-21T16:41:51.941085113Z","modified_time":"2026-09-21T16:40:35Z","sha256":"f77cc8d6070e9dacd7bed984ec2c1fa0fb9c6bfd6b0c35773af6a51883fd8a99","source":"amazon-inspector","versions":["0.4.107"]},{"id":"IN-MAL-2026-020255","import_time":"2026-09-21T16:41:51.997852793Z","modified_time":"2026-09-21T16:40:44Z","sha256":"5ad67de1b4a69749f36f044dbd668eadebabdea273dc2e234a1fde6dd3642ab3","source":"amazon-inspector","versions":["0.4.108"]},{"id":"IN-MAL-2026-020256","import_time":"2026-09-21T16:41:52.047727139Z","modified_time":"2026-09-21T16:40:54Z","sha256":"c17fc75dead13dd1cff5263e310b23aedcc04851aa16aa78fd869ba658c3aece","source":"amazon-inspector","versions":["0.4.109"]},{"id":"IN-MAL-2026-020428","import_time":"2026-09-23T04:44:14.432274055Z","modified_time":"2026-09-23T04:27:11Z","sha256":"259f190681303ac7ad3b27ceaefd88f8b25add57bc1dd64191bdd1bdccd3e9f4","source":"amazon-inspector","versions":["0.2.1"]},{"id":"IN-MAL-2026-020433","import_time":"2026-09-23T04:44:15.046067743Z","modified_time":"2026-09-23T04:27:59Z","sha256":"4c8c8e1793671adc449210c518cd4ac66103be881c21c4ac54bbae4fb7222a0d","source":"amazon-inspector","versions":["0.1.7"]},{"id":"IN-MAL-2026-020432","import_time":"2026-09-23T04:44:14.934350467Z","modified_time":"2026-09-23T04:27:49Z","sha256":"4d5d82f8a9418df93dedf25bf83560393d20580e82d044185e340f7cc93b369b","source":"amazon-inspector","versions":["0.1.4"]},{"id":"IN-MAL-2026-020431","import_time":"2026-09-23T04:44:14.843917597Z","modified_time":"2026-09-23T04:27:37Z","sha256":"53d2427c02acb3014ad2b0e68d76891cdcd010b6181895a0eda52ef913712932","source":"amazon-inspector","versions":["0.1.5"]},{"id":"IN-MAL-2026-020434","import_time":"2026-09-23T04:44:15.14335656Z","modified_time":"2026-09-23T04:28:10Z","sha256":"e0d0559266c9eb8c39c13b4c9af36d0ee760d1d0659190964bb2d619368ce1f0","source":"amazon-inspector","versions":["0.1.3"]},{"id":"IN-MAL-2026-020429","import_time":"2026-09-23T04:44:14.511768584Z","modified_time":"2026-09-23T04:27:19Z","sha256":"3dec04fde72aac47376d3d4bb5721aeb5f9b71d8e3d060578f984251bab15123","source":"amazon-inspector","versions":["0.2.0"]},{"id":"IN-MAL-2026-020426","import_time":"2026-09-23T04:44:14.13796789Z","modified_time":"2026-09-23T04:26:54Z","sha256":"528be6392baa0471a4b161b23084b14bdfb26e736e29e07e8a44d3b31163bc30","source":"amazon-inspector","versions":["0.1.0"]},{"id":"IN-MAL-2026-020427","import_time":"2026-09-23T04:44:14.255806695Z","modified_time":"2026-09-23T04:27:02Z","sha256":"52fd03c3ee27a8b1cb123273cddb488bf53caf324ce5fd9e65132d2d36643054","source":"amazon-inspector","versions":["0.2.2"]},{"id":"IN-MAL-2026-020430","import_time":"2026-09-23T04:44:14.600905657Z","modified_time":"2026-09-23T04:27:28Z","sha256":"6c5edecd3355e733c0272ce6bf9ccab41ae299c1d943c3de93ac5650b04442ae","source":"amazon-inspector","versions":["0.1.8"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}