qowa

{"schema_version":"1.7.4","id":"MAL-2026-18218","published":"2026-10-23T08:21:14Z","modified":"2026-10-26T06:41:40.513666903Z","summary":"Malicious code in qowa (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (650ce7eeda9c50d942912db7495f8108fcc3b8447ff9bae79a1bd1b105c1b0d5)\nsrc/qowa/__init__.py contains calls to socket.gethostname() at lines 30, 52, and 247 together with hardcoded Telegram Bot API endpoints (api.telegram.org/bot<token>/...) at lines 117 and 135. The code reads installer host identity and transmits it to an attacker-controlled Telegram bot channel, a known pattern for host-reconnaissance exfiltration using Telegram as a C2/collector. The embedded bot token encodes the destination chat under the operator's control, so installing or importing this package leaks the installer's hostname (and any other collected context) off-host to a third party. The package has no documented purpose that would legitimize Telegram-bot delivery of hostname data.\n\n## Source: kam193 (67fe6a2b86c60720a8e3cc1002c183bd751ec1896d3be13a44b5ce7d1623afbd)\nThe package provides a C2 server and agent with pre-filed credentials, disguised as a generic utility.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-qowa\n\n\nReasons (based on the campaign):\n\n\n - rat\n\n\n - spyware-like\n\n\n - target:android\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n\n - uses-telegram-bot\n\n\n - files-exfiltration\n","affected":[{"package":{"name":"qowa","ecosystem":"PyPI"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/qowa/__init__.py","sha256":"e780d6429bb306c93e0396d55260557adc08fee96f1582dcab72e5994688f44d","tlsh":"dc42945a9d567a22d3a7d26c2ca1d252f32aad1354062834becc53d8bf4c075c2fd6ac"}],"package_integrity":[{"filename":"qowa-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"78511cca9145589616a7421817a0d7ca2456afc7d54e45f8954b1e3cfecb0cc1","md5":"7905b8465cf6db7a5a9a7024214ad0b8","sha256":"50416008e3b52c84097352effd97d20c8de2d51f5005b7da6696c52593f07544"}},{"filename":"qowa-0.1.0.tar.gz","hashes":{"blake2b_256":"2dd0339c8d8480f9fc63d28c65aab91dd727434d101c56154e86e334b6015cf6","md5":"b55f6b40f12fbe9345fa54f3aec93b20","sha256":"9db92cad9c17a448b86cfe4a81b5ed292083e3cb41dd8b075355eb8858d6af89"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/qowa"},{"type":"PACKAGE","url":"https://pypi.org/project/qowa/0.1.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-qowa/qowa","import_time":"2026-10-23T08:47:28.5113769Z","modified_time":"2026-10-23T08:21:14.1804Z","sha256":"67fe6a2b86c60720a8e3cc1002c183bd751ec1896d3be13a44b5ce7d1623afbd","source":"kam193","versions":["0.1.0"]},{"id":"IN-MAL-2026-021781","import_time":"2026-10-26T06:39:42.569855281Z","modified_time":"2026-10-26T06:32:02Z","sha256":"650ce7eeda9c50d942912db7495f8108fcc3b8447ff9bae79a1bd1b105c1b0d5","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}