extera-runtime

{"schema_version":"1.7.4","id":"MAL-2026-18633","published":"2026-11-04T17:18:25Z","modified":"2026-11-08T10:13:03.536743105Z","summary":"Malicious code in extera-runtime (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (af4f783a1272f2f3b0596fd936a58e19320e6cb2c3fe05e523b8c989eb37b67d)\nextera-runtime 1.1.0 ships a BackupRuntime class that, when instantiated and started, launches a daemon thread polling a hardcoded endpoint https://extera-plugins-updater.top/cmd for operator commands. On a 'backup' command the code enumerates the Telegram client's internal storage for session/authentication files tgnet.dat, accounts_map.json, and userconf*.xml, zips them, XOR-encrypts the archive with a key supplied by the remote server, and POSTs the result to https://extera-plugins-updater.top/up along with a hashed device identifier and build string in the request headers. The stolen tgnet.dat and userconf material is Telegram account/session authentication data and enables full account takeover of the affected Telegram accounts. The destination domain extera-plugins-updater.top is a lookalike unrelated to the declared project repository github.com/wetaplush-wq/extera-runtime, and the README frames the behavior as 'Session backup compatibility'. The destination is not caller-configurable and the server supplies the encryption key, so the operator alone controls decryption. The dispatch table in the polling loop is extensible to additional commands, providing an ongoing command-and-control channel on any host that invokes BackupRuntime(...).start().\n\n## Source: kam193 (400bf2ff64fec2a3d26fa477d19f25b0d2abfdc40ae5247531a128cfdc41aa19)\nThe package provides functionality to exfiltrate sensitive Telegram files. The malicious code does not start automatically.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-extera-plugin-runtime\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n\n - files-exfiltration\n\n\n - target:telegram\n","affected":[{"package":{"name":"extera-runtime","ecosystem":"PyPI"},"versions":["1.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["extera_runtime-1.1.0.tar.gz","extera_runtime-1.1.0-py3-none-any.whl"],"path":"extera_plugin_runtime/runtime.py","sha256":"9ea109ed378e6159865019bf3c4bae44200ed414e675da349a5a8de05a380207","tlsh":"cad153f6ad551c92e343d49e4866b983732bb907180d4538b4fca3981fd8474c1fade9"},{"artifacts":["extera_runtime-1.1.0.tar.gz"],"path":"README.md","sha256":"9e812004df5cdf7fec36d5878c6b4be68cbb32771429c8a232bb4eeb56d07b72","tlsh":"5f21653c595a71201835caa3c73d23e3476bd7d927b3842549b822b78d0b893430775d"}],"package_integrity":[{"filename":"extera_runtime-1.1.0-py3-none-any.whl","hashes":{"blake2b_256":"7e87505cb8dde4e2f1e250967f360c38b7e9400e19ab23c751416e0bacf3699e","md5":"a004a805b0d191c39aa1ed204e4a91c2","sha256":"7322dd88c0e9ab680faf0b7d79789d465b1c608f1c031126b31cdb0445686838"}},{"filename":"extera_runtime-1.1.0.tar.gz","hashes":{"blake2b_256":"c8f8bb54862a70ec1e543e9def4f9a7e3f3d336168f91f5fd0066afe038e3f2c","md5":"02eb99bacf12bcbcd10ab505a71c4b46","sha256":"ce0e8a036f60368beaad491ae6ebdd5c42fecac301c58b90cee3bb5df11f4a00"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/extera-runtime"},{"type":"PACKAGE","url":"https://pypi.org/project/extera-runtime/1.1.0/"}],"database_specific":{"iocs":{"domains":["extera-plugins-updater.top"]},"malicious-packages-origins":[{"id":"pypi/2026-11-extera-plugin-runtime/extera-runtime","import_time":"2026-11-04T17:36:48.393310498Z","modified_time":"2026-11-04T17:18:25.657325Z","sha256":"400bf2ff64fec2a3d26fa477d19f25b0d2abfdc40ae5247531a128cfdc41aa19","source":"kam193","versions":["1.1.0"]},{"id":"IN-MAL-2026-022576","import_time":"2026-11-08T10:11:10.022888079Z","modified_time":"2026-11-08T09:43:19Z","sha256":"af4f783a1272f2f3b0596fd936a58e19320e6cb2c3fe05e523b8c989eb37b67d","source":"amazon-inspector","versions":["1.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}