scrapetools2

{"modified":"2026-09-27T14:41:05Z","published":"2026-09-27T14:33:48Z","schema_version":"1.7.4","id":"MAL-2026-17199","summary":"Malicious code in scrapetools2 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (44124d389269a5e4dc8801d3af1afeb08aee57313fcc7082570c5890e7d89233)\nscrapetools2 1.2.1 ships an auto-update mechanism in downloader.py that fetches tar.gz payloads from public IPFS gateways (eu.orbitor.dev, dget.top, ipfs.filebase.io) at the author-controlled IPNS name k51qzi5uqu5dmh5178x8jzdkz8u3k3qona4zrwlvdr6865it3901l1oe8emjwc, decrypts an 'updates' entry using a Fernet key bundled inside the package (scrapetools2/versions), writes each decrypted blob to scrapetools2/modules/N.py, and then compile()+exec()s them in-process. The updater is invoked via runtime.DBConsumer.startQueue -> updater() and loops on a 60-second interval, so any code path that reaches the advertised RuntimeSite/browser-pool flow triggers the fetch-and-execute cycle. The package additionally ships an encrypted 'updates' blob decrypted by packer.unpackdata into a JSON {\"cmd\":...} whose contents are written to modules/*.py and exec'd by run_modules(); the executed source is not visible in the sdist without the bundled key. Because IPNS is a mutable pointer under the holder's control and the only integrity check is a Fernet key shipped with the package, whoever controls the IPNS name can push arbitrary Python that will be executed on installer hosts.\n","affected":[{"package":{"ecosystem":"PyPI","name":"scrapetools2"},"versions":["1.2.1","1.2.0","0.2.0","0.2.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scrapetools2/downloader.py","sha256":"f6de293017d338dfe34f90026e76012f6ae7eb2d18e7e6d9f963199e8cd1314c","tlsh":"2db1a453d8a6aeba9367d47c086ad151b335a9073b1042743ffc62a80f4563947e47ec"},{"path":"scrapetools2/packer.py","sha256":"b140d03415affdb26eb34dd8ba6bee4c4fac05bc106baf1e4fd31b27a68a6bd7","tlsh":"932198a1bcd91a80d38bc0284422c910f2a9bc5f1301a1657e8cabe4af8817ff6a45cd"}],"package_integrity":[{"filename":"scrapetools2-1.2.1-py2.py3-none-any.whl","hashes":{"blake2b_256":"609a817a6d63406fd35c09ee2be49d50210313c81903a935410366e2e38fa214","md5":"7cf44493b43d599944e6c3a803a5e736","sha256":"e0f1f58f241c64e04e3f7946436403c695e30040dc7733b97cd69dcc30d77168"}},{"filename":"scrapetools2-1.2.1.tar.gz","hashes":{"blake2b_256":"02730598c74da7b7e25a8fac62c6951ec15cf25b3091ae6ebab46778306591d8","md5":"22bafa8e1af53276d230ab5a415bff6e","sha256":"8d4d42e93e67612862888adb1bee1c1254a8ed21aa30570b438a47b291759eee"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/scrapetools2/1.2.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/scrapetools2/1.2.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/scrapetools2/0.2.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/scrapetools2/0.2.1/"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020574","import_time":"2026-09-27T14:39:14.047216022Z","modified_time":"2026-09-27T14:33:48Z","sha256":"44124d389269a5e4dc8801d3af1afeb08aee57313fcc7082570c5890e7d89233","source":"amazon-inspector","versions":["1.2.1"]},{"id":"IN-MAL-2026-020575","import_time":"2026-09-27T14:39:14.122558966Z","modified_time":"2026-09-27T14:33:58Z","sha256":"8510a108179eb7e480d606cb4f037c1365007926af575afc80ec0d9f077f1b0a","source":"amazon-inspector","versions":["1.2.0"]},{"id":"IN-MAL-2026-020576","import_time":"2026-09-27T14:39:14.180076006Z","modified_time":"2026-09-27T14:34:10Z","sha256":"cf460a24ad3c20f436eb20e2974b090ae761ebb02e170d92c34aadf23b320007","source":"amazon-inspector","versions":["0.2.0"]},{"id":"IN-MAL-2026-020577","import_time":"2026-09-27T14:39:14.234216761Z","modified_time":"2026-09-27T14:34:20Z","sha256":"d1ccba931f3617a01ef93e1f81268e9cd3cc74645566804cb1ab64e53f6ded64","source":"amazon-inspector","versions":["0.2.1"]}]}}