shortneer

{"schema_version":"1.7.4","id":"MAL-2026-17422","published":"2026-10-01T21:00:49Z","modified":"2026-10-04T23:42:41.588985958Z","summary":"Malicious code in shortneer (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4960c121d2fbf6337d33df0c6a304f4f3e968d18c64614c323ac5f8389020bab)\nThe package ships a macOS arm64 Rust-compiled Python extension (_core.abi3.so) fronted by a thin wrapper lb.py. The only exposed Python function, shortname(), invokes two gibberish-named native entrypoints (_core.dphjx0rdhx0 and _core.ioluli0x0xthf) and swallows all exceptions with a silent print(''). The native binary embeds the hardcoded path 'Library/Application Support/Telegram Desktop/tdata' (the installer's Telegram Desktop session store on macOS), the archive name 'fghj.zip', and the destination 'https://api.telegram.org', alongside zip, AES, ChaCha20 and reqwest/rustls/hyper HTTP client code. This matches packaging the installer's live Telegram Desktop session directory and uploading it to a Telegram bot controlled by the author, which grants full takeover of the installer's Telegram account. The random-looking native export names and the blanket exception suppression serve to hide the behavior from casual inspection; the package's self-description as an OSINT utility does not match its actual data flow, which targets the installer's own messaging session store rather than any user-supplied target.\n\n## Source: kam193 (5e166ae1253c886885381cb5087f67a59a869cad6ece6f3ac40aefc6e463c27f)\nWhen used, the package exfiltrates Chrome extension files (likely targeting cryptocurrency wallets) and sensitive Telegram files.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-sherpy\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - exfiltration-crypto\n\n\n - target:telegram\n\n\n - native-extension\n","affected":[{"package":{"name":"shortneer","ecosystem":"PyPI"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"shortneer/_core.abi3.so","sha256":"7c54bf444a90dac69f2d2a833cf669a8bdee97cb534b1271d1a53d1c68d09ca4","tlsh":"6666ae0ba60d2c5fc3c7b0bf8d6944a82167b2503114d2da3c19af2eed56bd1463eb79"},{"path":"shortneer/lb.py","sha256":"f0b4f691f41da2e9b203a3c6be61862c98bc208fa8d6cc489d2293e5287d242c","tlsh":"c8d012210c208d22c283e4a840b080a1a21b3e2399902a3afcdc82465fe113187fe9fe"}],"package_integrity":[{"filename":"shortneer-0.1.0-cp39-abi3-macosx_11_0_arm64.whl","hashes":{"blake2b_256":"b3ce2533a46fcb7d8d0f757049b0760c8875836850a0900c246981032d5abe0e","md5":"7fcf98620bfb1f0b51bfb8c1c3c3263d","sha256":"38c9cdde131c1be27d5f410b6a8f37ef45a1adf7b13ed769b1176de588179178"}},{"filename":"shortneer-0.1.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","hashes":{"blake2b_256":"f5ab5983f7ce85a13215286c0e31b703bd15b8405e21e7bae5459dfeea1e821f","md5":"d681c5a069d0fdb7f5b1f84c25809d78","sha256":"ba182eb5c7a15322c50b5d7d3beac9f8c213866a6a658dd898126968c4747404"}},{"filename":"shortneer-0.1.0-cp39-abi3-win_amd64.whl","hashes":{"blake2b_256":"0643fff61c5265ef83af32fdc13b7648d8dffb1600e7ef0ba6364dab18ba8cb6","md5":"ab95f517c0620490cc715770b2b8f30f","sha256":"2a67217fe8bcbf49049f3f444d28d033bcec1ce7cf680cb180a228c490869ffd"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/shortneer"},{"type":"PACKAGE","url":"https://pypi.org/project/shortneer/0.1.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-09-sherpy/shortneer","import_time":"2026-10-01T21:42:15.070973594Z","modified_time":"2026-10-01T21:00:49.972775Z","sha256":"5e166ae1253c886885381cb5087f67a59a869cad6ece6f3ac40aefc6e463c27f","source":"kam193","versions":["0.1.0"]},{"id":"IN-MAL-2026-020936","import_time":"2026-10-04T23:40:43.739205311Z","modified_time":"2026-10-04T23:22:32Z","sha256":"4960c121d2fbf6337d33df0c6a304f4f3e968d18c64614c323ac5f8389020bab","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}