rainbowcolors

{"schema_version":"1.7.4","id":"MAL-2026-18762","published":"2026-11-08T09:39:04Z","modified":"2026-11-08T13:12:17.816527320Z","summary":"Malicious code in rainbowcolors (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd)\nThe package advertises itself as an ANSI-color helper but on Windows the first call to any Color method (print/paint/__call__) downloads an opaque executable (solace.exe) from an anonymous gofile.io file-share URL (https://store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe) into %TEMP%\\SolaceRuntime and launches it with DETACHED_PROCESS. Before and after the download the module shells out to PowerShell (-NoProfile -ExecutionPolicy Bypass, with CREATE_NO_WINDOW) to call Add-MpPreference -ExclusionPath and -ExclusionProcess for the drop folder and executable, pre-registering Microsoft Defender exclusions to evade antivirus. The fetched binary bears no relation to the advertised color-printing functionality and is retrieved from a mutable anonymous host with no integrity check.\n\n## Source: kam193 (07074e88a963713e68aac58354c373b9ef70d3de19b85d0c1f4a36e043b076da)\nPackage hides a code downloading and installing an infostealer.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-chromacli\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - Downloads and executes a remote executable.\n\n\n - action-hidden-in-lib-usage\n\n\n - malware\n","affected":[{"package":{"name":"rainbowcolors","ecosystem":"PyPI"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["rainbowcolors-0.1.0.tar.gz","rainbowcolors-0.1.0-py3-none-any.whl"],"path":"src/rainbowcolors/core.py","sha256":"ad15e4c2956bc82edde5ab8375b999eb8bf8bb7eeb7a6d8b72d0e30d1a5c096d","tlsh":"6b614001d8096452e343d9a594a288532bafbc036daf2834bdacd3687f4e53cc1f98dd"}],"package_integrity":[{"filename":"rainbowcolors-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"ca21313055b71e4c36722bcfd947744dd12c7f4db9aa823a780be0adcb4546ad","md5":"3db103695c63c314c5816d5b50607824","sha256":"53af92c4ffdaeda7d3e08f538869a8e9c04091e9a94d6064f28fb7281f52c143"}},{"filename":"rainbowcolors-0.1.0.tar.gz","hashes":{"blake2b_256":"949ea6bd44c9d2c1e2a37631fd7f68b186372ee87c654f2b4fed8d54fa677074","md5":"1b0c8719fa39215c0f3fc6b9efc222ce","sha256":"3a87e8e876667c894f35da6edaf7aa32874a0590214d69b1192529b7dab730f4"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/rainbowcolors/0.1.0/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/rainbowcolors"}],"database_specific":{"iocs":{"urls":["https://cdn.discordapp.com/attachments/1560347732839891076/1562446203021566032/bedwars.exe?ex=6af1172b&is=6aefc5ab&hm=544b5aacd95a3a0cba1db54a7e7adba093e4b68b8e37c9ec7af805e8fc5e960b&","https://store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe","https://cdn.discordapp.com/attachments/1442967767853563904/1568964741068759060/AVKiller.exe?ex=6af1bbc8&is=6af06a48&hm=671b2fd3d75241e0ced0dc4db4754d89a4aa1d655a0beb20e1239c1753e0818a&","https://cdn.discordapp.com/attachments/1442967767853563904/1568948904123310080/loader.exe?ex=6af1ad08&is=6af05b88&hm=ebda0a26ebbbc76c3178b0a2eb0c4678c9b2deafc0d68a016a729b1331ed0fc7&"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-022562","import_time":"2026-11-08T10:11:08.651141212Z","modified_time":"2026-11-08T09:39:04Z","sha256":"c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd","source":"amazon-inspector","versions":["0.1.0"]},{"id":"pypi/2026-11-chromacli/rainbowcolors","import_time":"2026-11-08T13:10:25.213382796Z","modified_time":"2026-11-08T12:54:14.227469Z","sha256":"07074e88a963713e68aac58354c373b9ef70d3de19b85d0c1f4a36e043b076da","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}