getpubip

{"schema_version":"1.7.4","id":"MAL-2026-17884","published":"2026-10-15T10:13:20Z","modified":"2026-10-26T18:58:24.238534230Z","summary":"Malicious code in getpubip (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6d316a35a6fe335032b2c59e47627c0af28bec9688cba40585f1365cab4f4452)\ngetpubip/__init__.py runs exec() on an approximately 2KB opaque payload produced by reversing a string literal, base64-decoding it, and zlib-decompressing it (lambda __: __import__('zlib').decompress(__import__('base64').b64decode(__[::-1])); exec(_(b'...'))). The package advertises itself as a three-line helper that returns the host's public IP by calling ipify, and a clean implementation of that functionality exists in core.py; __init__.py does not re-export get_ip and its only effect on import is to execute the hidden blob. The payload is reached whenever a consumer runs `import getpubip` or `python -m getpubip`, so any installer that uses the package executes the concealed code with no further user action. The triple-layered obfuscation (string reverse, base64, zlib) and single-character identifiers are deliberately chosen to hide the executed code from reviewers; whatever the decoded bytes do runs in the installer's process on first import.\n\n## Source: kam193 (6a07d6dd387bbd88252ffdda7f8c10daf988f0622250daf20e7ec8ee0f63c6d5)\nDuring import, obfuscated code downloads and executes an infostealer. Campaign shares some similarities with the campaign 2026-10-fontcase.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-getpubip\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - infostealer\n\n\n - exfiltration-browser-data\n\n\n - obfuscation\n","affected":[{"package":{"name":"getpubip","ecosystem":"PyPI"},"versions":["0.1.0","0.1.1","0.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"getpubip/__init__.py","sha256":"737351e320abeac2e656790d650c87565aa13e79460552d7162d77b779e42b40","tlsh":"35618efeafe46ca7f9610b6dc3418884218749057616b204c9bedbfb577203035c1b17"}],"package_integrity":[{"filename":"getpubip-0.1.1-py3-none-any.whl","hashes":{"blake2b_256":"609397a624483c8b7321c4a152e20b83e79e184a574bf40d13ea53ef4beb1f7f","md5":"ed3967f1d812ff61faf3d2bd2edea7d4","sha256":"9b7cbdb0e2de96076ef7f8dfe87012e467b3a84b170e241842149bce8387ef68"}},{"filename":"getpubip-0.1.1.tar.gz","hashes":{"blake2b_256":"f1cf3bba655290fe7f189a171f3fd1e5a31ed7fc6e71b692dbe3444ed2bd20de","md5":"aaece4ec17b372ae98e65814d0d09538","sha256":"92288e33cce14f3318a1741bdae091c53e2e21086f231a9a8cf129a135de112e"}}]}}}],"references":[{"type":"EVIDENCE","url":"https://tria.ge/261015-hppmhsgx51"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/getpubip"},{"type":"PACKAGE","url":"https://pypi.org/project/getpubip/0.1.1/"}],"database_specific":{"iocs":{"domains":["api-bsx.pages.dev"],"urls":["https://api-bsx.pages.dev/download"]},"malicious-packages-origins":[{"id":"pypi/2026-10-getpubip/getpubip","import_time":"2026-10-15T10:43:09.275286028Z","modified_time":"2026-10-15T10:13:20.123974Z","sha256":"6a07d6dd387bbd88252ffdda7f8c10daf988f0622250daf20e7ec8ee0f63c6d5","source":"kam193","versions":["0.1.0","0.1.1","0.1.2"]},{"id":"IN-MAL-2026-021819","import_time":"2026-10-26T18:56:20.850159877Z","modified_time":"2026-10-26T18:37:24Z","sha256":"6d316a35a6fe335032b2c59e47627c0af28bec9688cba40585f1365cab4f4452","source":"amazon-inspector","versions":["0.1.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}