onsokets

{"schema_version":"1.7.4","id":"MAL-2026-18219","published":"2026-10-23T12:42:59Z","modified":"2026-10-26T18:58:24.314905022Z","summary":"Malicious code in onsokets (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (86e89c263593521f9795193907958f4c642d34253fe9a65526dea1c681808760)\nonsokets/run.py walks the Android primary storage path /storage/emulated/0/, collects files ending in.json,.py,.pyrubi, and.txt, zips them by extension, and POSTs each archive to https://tapi.bale.ai/bot<token>/sendDocument with chat_id 5263487757. The Bale bot token is hardcoded in the source as the default for BALE_BOT_TOKEN, so installing or running this package exfiltrates installer-owned source, configuration, and text files to an author-controlled Bale chat. The destination is not caller-configurable in any meaningful sense and does not relate to any declared purpose of the package.\n\n## Source: kam193 (844774819aa502a53d6d364b6636fa62eb412fe8b30973c226aeb9b7b89865f9)\nThe package contains code for automated files exfiltration.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-proxyrubika\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - target:android\n","affected":[{"package":{"name":"onsokets","ecosystem":"PyPI"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"onsokets/run.py","sha256":"d81315e6c1fb013c625c6e66cdf7ff460c3829ee2dde43b1b0f9a08e7edc3be6","tlsh":"1531114628002f70d2c3823e48559854432b7dab7403f925759d63a48fa2c724f62bcc"}],"package_integrity":[{"filename":"onsokets-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"3b754bf09cd3ffcb7d43507df43d1e7793a138ff5d694f6936d3b0421788e56a","md5":"28cb4ea904b6e21a9a41407222fc7f1e","sha256":"208682a9e8f05277f9d3ef1e060fd6c856759e3cc140cdcb9dec2868153d045d"}},{"filename":"onsokets-0.1.0.tar.gz","hashes":{"blake2b_256":"a2f5c157fb0f12da879217946c40855a0d3d2333ec42a1c981f576a04536940c","md5":"db17494c55e7c09b2f810682f30343ca","sha256":"a48762fc55387da109c3013c78ea6a725080b554426e0d1e419125c00e87b6c9"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/onsokets"},{"type":"PACKAGE","url":"https://pypi.org/project/onsokets/0.1.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-proxyrubika/onsokets","import_time":"2026-10-23T13:17:20.702240213Z","modified_time":"2026-10-23T12:42:59.93431Z","sha256":"844774819aa502a53d6d364b6636fa62eb412fe8b30973c226aeb9b7b89865f9","source":"kam193","versions":["0.1.0"]},{"id":"IN-MAL-2026-021814","import_time":"2026-10-26T18:56:20.410506985Z","modified_time":"2026-10-26T18:36:48Z","sha256":"86e89c263593521f9795193907958f4c642d34253fe9a65526dea1c681808760","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}