zencleaner

{"schema_version":"1.7.4","id":"MAL-2026-17629","published":"2026-10-03T22:47:45Z","modified":"2026-10-29T13:38:41.632501831Z","summary":"Malicious code in zencleaner (PyPI)","details":"When a license key is activated or deactivated in the local UI, zencleaner/webhook_logger.py posts the key, the PC name, the Windows user name and the client IP to a hardcoded Discord webhook, although the README says nothing is sent to the internet. 1.0.3 and 1.0.3.1 also look up the public IP through ipify.org and ifconfig.me. Separately, cleaner_system.py clears the Windows event logs, Security included, with wevtutil; a comment in that function reads \"so forensic scanners report 0 entries\". Nothing runs at install time. I read all three versions and did not run them.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b619bf84ab0ccce9d7a00ee6cafa8f950e8591e2664f8d11d73baf2c8adcbaf5)\nzencleaner 1.0.3.1 advertises itself as a fully local Windows cleaner bound to 127.0.0.1 with 'no telemetry, no data collection, no outbound calls'. In practice, the local web server's license activate/deactivate handler calls a webhook_logger that POSTs the caller-supplied license key (up to 100 characters), the Windows COMPUTERNAME, the Windows USERNAME, a hardware identifier (HWID), and the machine's public IP to a hardcoded Discord webhook at discord.com/api/webhooks/1555423493796012102/. When the request originates from 127.0.0.1, _public_ip() fetches https://api.ipify.org with a fallback to https://ifconfig.me/ip solely to deanonymize the installer's real public IP before it is included in the Discord message. The outbound channel is not documented and directly contradicts the README's local-only claim; the caller-supplied license key and host identity leave the installer's machine on every license action.\n","affected":[{"package":{"name":"zencleaner","ecosystem":"PyPI"},"versions":["1.0.0","1.0.3","1.0.3.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"zencleaner/webhook_logger.py","sha256":"f29ff754814475825bf958d71806239c1d29b9f48e0f72c81237db4957f62c10","tlsh":"d6a183d3cd4e28278972801d5c15c542f736634b5a861b23fc6c972c2fbc826e2f69e8"}],"package_integrity":[{"filename":"zencleaner-1.0.3-py3-none-any.whl","hashes":{"blake2b_256":"93a44038264e3499c272418796e991ab93304c76cf40b72edab56f094d51bb0f","md5":"7b8436161547c34588e395fa9ce73f72","sha256":"aab5a9386aad08bcad8d65c33f31316a98fbca0f28661361b8b4243137ed063c"}},{"filename":"zencleaner-1.0.3.tar.gz","hashes":{"blake2b_256":"d9aa53b6344c8f1dbf3fb48d200adc165f270b872ebea71908e369f1a8effb83","md5":"220ccd5cb11985ffbb36c011500630c5","sha256":"f800e0c6e3dd8616d4b7d7b19bd5e4d844f393d07d720c38daec90c174dcdf2c"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/zencleaner/1.0.3/"},{"type":"PACKAGE","url":"https://pypi.org/project/zencleaner/1.0.3.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/zencleaner/1.0.0/"}],"database_specific":{"iocs":{"urls":["https://discord.com/api/webhooks/1555423493796012102"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-021890","import_time":"2026-10-29T13:37:15.286943441Z","modified_time":"2026-10-29T13:21:20Z","sha256":"60c193b2d22582c3dc5955d00df1f5d5c8629656e7cacf1e479d2430ef12d927","source":"amazon-inspector","versions":["1.0.3"]},{"id":"IN-MAL-2026-021889","import_time":"2026-10-29T13:37:15.23230499Z","modified_time":"2026-10-29T13:21:14Z","sha256":"b619bf84ab0ccce9d7a00ee6cafa8f950e8591e2664f8d11d73baf2c8adcbaf5","source":"amazon-inspector","versions":["1.0.3.1"]},{"id":"IN-MAL-2026-021938","import_time":"2026-10-29T13:37:17.320030981Z","modified_time":"2026-10-29T13:27:36Z","sha256":"dbc6ebf2578c396e1a4f56e835f5dd9537e17de37002934aecf35913cf93c61d","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"smiling-hyena","contact":["smilinghyena4@gmail.com"],"type":"FINDER"}]}