ukraine69

{"schema_version":"1.7.4","id":"MAL-2026-17919","published":"2026-10-17T16:53:55Z","modified":"2026-10-26T06:41:40.600571745Z","summary":"Malicious code in ukraine69 (PyPI)","details":"Importing `ukraine69` in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local `.vault` files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts `account.deleteAccount` using GoyGram, with a Telethon fallback in versions 1.2.5–1.2.8. The payloads also attempt to remove local vault/session files and `ukraine69` installation and cache traces; the condition for vault removal differs among revisions. Versions 1.2.5–1.2.8 specifically target Hotaru session vault layouts, and 1.2.7–1.2.8 additionally try `auth.checkPassword` if a password is present in the vault. Version 1.2.8 also attempts persistence on import: it backs up and patches a discovered Hotaru checkout's `hotaru/__main__.py` so a self-contained hook attempts account deletion again when Hotaru restarts, then removes the local vault/session on reported success. Version 1.2.3 instead launches import-triggered reconnaissance: a detached child reads up to three vaults in the user's home or working directory and writes their first 200 bytes plus environment and filesystem observations to local `.u69_recon.log` files. No external exfiltration or account-deletion call appears in 1.2.3. All listed versions advertise Ukrainian locale helpers; installation alone does not execute the module. Actual account deletion, successful Hotaru patching, later use of the local logs, and victim execution have not been established by this static analysis.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4b8244951c9ae4f7baac94c3e7fd803e3c3ceaa27d64c2561cce098bd9dddf77)\nThe package's __init__.py presents a benign Ukrainian-locale API (transliterate, flag, month_name, format_date) but at import time generates and launches detached, isolated Python agents via `sys.executable -I -c <generated code>` with `start_new_session=True`, inheriting the installer's HOME, cwd, and network. The spawned agents glob the installer's filesystem (`~/.hotaru/**`, `~/.local/share/hotaru/**`, `~/**/*.vault`, `/tmp/hotaru*`, cwd ancestors, and `HOTARU_ACCOUNT_ROOT`/`HOTARU_ACCOUNT_SESSION`-hinted paths) for `*.vault` files, decrypt them via `goygram.security._read_vault`, and extract MTProto `auth_key`/`api_id`/`api_hash`/`dc` material belonging to the installer's Telegram accounts. Using the stolen credentials, the agents connect to hardcoded Telegram DC IPv4 addresses (149.154.175.53, 149.154.167.51, 149.154.175.100, 149.154.167.91, 91.108.56.130) and invoke `account.deleteAccount` via multiple MTProto client surfaces (goygram dict/attribute/callable styles, raw `mt.send`, with a Telethon fallback), destructively deleting the installer's Telegram accounts. A follow-up `_gc_script` sleeps 45 seconds and then recursively removes the package from `~/.cache/hotaru/module-deps/<id>/`, `~/.cache/pip/wheels`, `~/.cache/pip/http-v2`, `~/.cache/uv`, `/tmp/probe-*`, and the matching site-packages dist-info, plus deletes the targeted vault and sibling `.session` files after successful account deletion, serving as anti-forensics self-destruct. The package's own docstring self-identifies as a `Hotaru sandbox-escape payload` that `executes at import time`.\n\n## Source: kam193 (751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a)\nDuring import, package performs actions intended to escape sandbox, find Telegram-bot session files and initiate malicious account deletion.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-ukraine69\n\n\nReasons (based on the campaign):\n\n\n - destructive-actions\n\n\n - covering-tracks\n","affected":[{"package":{"name":"ukraine69","ecosystem":"PyPI"},"versions":["1.2.0","1.2.1","1.2.2","1.2.3","1.2.5","1.2.6","1.2.7","1.2.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ukraine69/__init__.py","sha256":"6b36b90468c442a02d0cc6aaf3b401a96d54d34d85f6aac49b2bcb074aea44e6","tlsh":"b5f18620a4125823e347ea5e4916d0e02b1eb977350a5d74b9fc7e44ffcd6b182b46bc"}],"package_integrity":[{"filename":"ukraine69-1.2.1-py3-none-any.whl","hashes":{"blake2b_256":"94923895a2d5a934ea9f9c05d9f316d7bca905eb3fac863fdf3051aa14e4277b","md5":"e57c3121790dc1bbf5ed5da734bd5660","sha256":"576037f8bd79689977cdb4528b188acfe53f773025dac244825a08620ce8dfa0"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/ukraine69"},{"type":"PACKAGE","url":"https://pypi.org/project/ukraine69/1.2.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/ukraine69/1.2.6/"},{"type":"PACKAGE","url":"https://pypi.org/project/ukraine69/1.2.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/ukraine69/1.2.2/"},{"type":"PACKAGE","url":"https://pypi.org/project/ukraine69/1.2.8/"},{"type":"PACKAGE","url":"https://pypi.org/project/ukraine69/1.2.7/"},{"type":"PACKAGE","url":"https://pypi.org/project/ukraine69/1.2.5/"},{"type":"EVIDENCE","url":"https://inspector.pypi.io/project/ukraine69/1.2.0/packages/2c/3f/e51de071990c6e81c9f9d59b7adde323fd0dacd0e52961513ccae945aeb6/ukraine69-1.2.0-py3-none-any.whl/ukraine69/__init__.py#line.208"},{"type":"EVIDENCE","url":"https://inspector.pypi.io/project/ukraine69/1.2.1/packages/94/92/3895a2d5a934ea9f9c05d9f316d7bca905eb3fac863fdf3051aa14e4277b/ukraine69-1.2.1-py3-none-any.whl/ukraine69/__init__.py#line.208"},{"type":"EVIDENCE","url":"https://inspector.pypi.io/project/ukraine69/1.2.2/packages/45/be/70b11f7a1065b918fff7e273a8929cfec6117ba10f6da1b9651d6fc6b0a9/ukraine69-1.2.2-py3-none-any.whl/ukraine69/__init__.py#line.221"},{"type":"EVIDENCE","url":"https://inspector.pypi.io/project/ukraine69/1.2.3/packages/69/a0/b71eda561d5b482f528b562285e74dbdbc74a4879d1b328f3c5712f42621/ukraine69-1.2.3-py3-none-any.whl/ukraine69/__init__.py#line.120"},{"type":"EVIDENCE","url":"https://inspector.pypi.io/project/ukraine69/1.2.5/packages/98/2a/40f168e0a9989e6c72650df04f7ec3cc0b4e11481b5d987c7c6990d294b2/ukraine69-1.2.5-py3-none-any.whl/ukraine69/__init__.py#line.321"},{"type":"EVIDENCE","url":"https://inspector.pypi.io/project/ukraine69/1.2.6/packages/40/65/cf3c297418f42056da1aa1ac74dee1a2ada2bc9e7048701429acd6fb17f2/ukraine69-1.2.6-py3-none-any.whl/ukraine69/__init__.py#line.354"},{"type":"EVIDENCE","url":"https://inspector.pypi.io/project/ukraine69/1.2.7/packages/1e/b8/421ab6c05f83983a337619596ad8e40126aa6319afdc91d73865da43ff8e/ukraine69-1.2.7-py3-none-any.whl/ukraine69/__init__.py#line.406"},{"type":"EVIDENCE","url":"https://inspector.pypi.io/project/ukraine69/1.2.8/packages/64/23/da183671983a86a4c92daffd479996dc61e50c93ac6f73d62083294dec4d/ukraine69-1.2.8-py3-none-any.whl/ukraine69/__init__.py#line.861"},{"type":"PACKAGE","url":"https://pypi.org/project/ukraine69/1.2.3/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-ukraine69/ukraine69","import_time":"2026-10-17T17:38:26.306032386Z","modified_time":"2026-10-17T16:53:55.661733Z","sha256":"751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a","source":"kam193","versions":["1.2.0","1.2.1","1.2.2","1.2.3","1.2.5","1.2.6","1.2.7","1.2.8"]},{"id":"IN-MAL-2026-021519","import_time":"2026-10-18T01:52:23.72296384Z","modified_time":"2026-10-18T01:49:53Z","sha256":"33f42716a2bf353999fae2be805c5c9ca6ad9811920ee2ccec733a0647120831","source":"amazon-inspector","versions":["1.2.1"]},{"id":"IN-MAL-2026-021515","import_time":"2026-10-18T01:52:23.398656642Z","modified_time":"2026-10-18T01:49:18Z","sha256":"4b8244951c9ae4f7baac94c3e7fd803e3c3ceaa27d64c2561cce098bd9dddf77","source":"amazon-inspector","versions":["1.2.6"]},{"id":"IN-MAL-2026-021522","import_time":"2026-10-18T01:52:23.961292396Z","modified_time":"2026-10-18T01:50:15Z","sha256":"802aefe7084d5b846d6d2dec2b00c6c59c3ffd95e5c8a674653cf8c16e0558aa","source":"amazon-inspector","versions":["1.2.0"]},{"id":"IN-MAL-2026-021521","import_time":"2026-10-18T01:52:23.881468368Z","modified_time":"2026-10-18T01:50:05Z","sha256":"8e933b1d75adc3025a2cb071396e7db13f81da48da6a23bf4a84b2955e80d032","source":"amazon-inspector","versions":["1.2.2"]},{"id":"IN-MAL-2026-021518","import_time":"2026-10-18T01:52:23.635032435Z","modified_time":"2026-10-18T01:49:43Z","sha256":"9d6ffd39c8600f034e5e15148b7bbbab5b3d4454d3b0cb3a04af071af017e9d9","source":"amazon-inspector","versions":["1.2.8"]},{"id":"IN-MAL-2026-021517","import_time":"2026-10-18T01:52:23.556233738Z","modified_time":"2026-10-18T01:49:35Z","sha256":"ad925525ff7c3ccbb1e6859728387aeaf83681aa88829eda1406e70338f64b7e","source":"amazon-inspector","versions":["1.2.7"]},{"id":"IN-MAL-2026-021516","import_time":"2026-10-18T01:52:23.478882569Z","modified_time":"2026-10-18T01:49:29Z","sha256":"dff8e4c0a3df260243f56e218dce6c7092138e26578f8395fdeca348041835ce","source":"amazon-inspector","versions":["1.2.5"]},{"id":"IN-MAL-2026-021782","import_time":"2026-10-26T06:39:42.678592814Z","modified_time":"2026-10-26T06:32:08Z","sha256":"e83671739340bc474342bdad3264ae2fcb06374c72de34bdd57791ce9c355dbf","source":"amazon-inspector","versions":["1.2.3"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ESTsecurity","contact":["https://www.estsecurity.com/"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}