sysdiagd

{"schema_version":"1.7.4","id":"MAL-2026-17861","published":"2026-10-13T18:40:17Z","modified":"2026-10-29T14:16:01.437140830Z","summary":"Malicious code in sysdiagd (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8fdb099f519e4b3349d3800684dd052bd2eef6149061f36587fe69ffab780397)\nPackage sysdiagd version 1.2.2 on PyPI was examined across 15 files. No a static rule matches were produced and no concrete behavioral findings are available from the traced code review. The package name suggests a system diagnostics daemon, but no specific file, function, network destination, credential read, or install-time execution path has been corroborated with evidence in this record. Without a named installer-side data read tied to a specific destination, a named install-time or import-time execution path, or any other concrete fingerprint, the behavior of this version cannot be characterized as benign or malicious from the available signals alone.\n\n## Source: kam193 (0d396ad34176d29956d695014d261847ada859c184d7a8e7820d96087af7eafe)\nDisguised as a system monitoring tool, the package delivers a Discord bot acting as an infostealer exfiltrating credentials, browser data, files and recording audio, screenshots and video. The code requires providing bot credentials, it is not functional without providing them.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-sysdiagd\n\n\nReasons (based on the campaign):\n\n\n - rat\n\n\n - exfiltration-browser-data\n\n\n - persistence\n\n\n - exfiltration-credentials\n\n\n - files-exfiltration\n\n\n - spyware-like\n\n\n - infostealer\n","affected":[{"package":{"name":"sysdiagd","ecosystem":"PyPI"},"versions":["1.2.1","1.2.2","1.2.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"sysdiagd-1.2.3-py3-none-any.whl","hashes":{"blake2b_256":"66b31f82a48fec718d6a1193806f487628fd5f42dffccfdc9976c45634987b33","md5":"db92342f17302f6be426172b50d01fc3","sha256":"67640f3749cfb7b0bb05f5a0fec2885eb11f96b54a28dd01a3f706a88c48a86c"}},{"filename":"sysdiagd-1.2.3.tar.gz","hashes":{"blake2b_256":"7076f079d902157f75c81a1fd84d3ef4cd55db1a004b791167efe8e2f3d6c1d4","md5":"ba30ad48ff36cb02e93df98044b7b8cf","sha256":"b880cc2b3591c7b4cdf6220958381d0f139e1b7a1ad3336767258142b298293f"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/sysdiagd"},{"type":"PACKAGE","url":"https://pypi.org/project/sysdiagd/1.2.3/"},{"type":"PACKAGE","url":"https://pypi.org/project/sysdiagd/1.2.2/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-sysdiagd/sysdiagd","import_time":"2026-10-13T18:49:07.656255693Z","modified_time":"2026-10-13T18:40:17.5594Z","sha256":"0d396ad34176d29956d695014d261847ada859c184d7a8e7820d96087af7eafe","source":"kam193","versions":["1.2.1","1.2.2","1.2.3"]},{"id":"IN-MAL-2026-021978","import_time":"2026-10-29T13:37:18.56017813Z","modified_time":"2026-10-29T13:33:00Z","sha256":"8fe803d7d432e77b73f1005478bc0215255ec42c4f90836b7256e0661e35d2bf","source":"amazon-inspector","versions":["1.2.3"]},{"id":"IN-MAL-2026-022051","import_time":"2026-10-29T14:14:21.198253281Z","modified_time":"2026-10-29T13:42:23Z","sha256":"8fdb099f519e4b3349d3800684dd052bd2eef6149061f36587fe69ffab780397","source":"amazon-inspector","versions":["1.2.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}