toorc

{"modified":"2026-06-24T07:49:21Z","published":"2026-06-23T12:07:57Z","schema_version":"1.7.4","id":"MAL-2026-6290","summary":"Malicious code in toorc (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2cfd36909e089f17439dd3227c6f5ccef2fef2964dc26bbdbaaef0481b54615d)\nOn `pip install` (and even `pip download`), the package's setup.py overrides the `install` and `egg_info` commands to execute a RunCommand() routine that serializes every entry in `os.environ` into a key=value query string and captures the output of `ps -elf`. The combined payload is then POSTed via curl over plaintext HTTP to `http://gjampdwmdjmppwedtkpbbdkq05f6iiz6r.oast.fun`, a unique subdomain on the public interactsh out-of-band testing service. Any CI/build secrets present in the environment at install time (AWS_*, GITHUB_TOKEN, NPM_TOKEN, CI provider tokens, etc.) leak to the attacker-controlled OAST listener, along with a snapshot of running processes on the host.\n\n## Source: kam193 (02334bfe46d6509e7900323066c5bb2eda0d5a34a6906cee5ccca3abaecb3ade)\nDuring installation, the package exfiltrates env variables\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-06-ip-rotat\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - exfiltration-env-variables\n\n\n - typosquatting\n","affected":[{"package":{"ecosystem":"PyPI","name":"toorc"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.py","sha256":"e3e6401df3a293e4d7511661d7a71b6f6dace4b74bc9dd394c01647ae3848313","tlsh":"a8316207e0bf29291ec354a0558f03959bc0e3a32f6431fa71fc29191f0b129503b8af"}],"package_integrity":[{"filename":"toorc-0.0.1-py3-none-any.whl","hashes":{"blake2b_256":"8bffdd9a7245f0f8e1b80d434a0432079bd32d9e055a6e3472014d3eeaa593e9","md5":"87b8e80085e5c76fce43e6ee293a583d","sha256":"c8ead1ac2162b136fe0babfc1f6f34f4e3d9f499fc3f808e17db9ecf55e1ba5e"}},{"filename":"toorc-0.0.1.tar.gz","hashes":{"blake2b_256":"3d0684e0af55f5e3ccf134f7fe1d2efed1369b8085f3ec68077daa0c3a2ef65b","md5":"2aea2d99b8acf3bf0a5734cbd7f77e84","sha256":"aa94fe4ea2cab90497da15cd24b5c24be34a29d8b7b1ae1cb5efbb2091f843d2"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/toorc"},{"type":"PACKAGE","url":"https://pypi.org/project/toorc/0.0.1/"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]}],"database_specific":{"iocs":{"domains":["gjampdwmdjmppwedtkpbbdkq05f6iiz6r.oast.fun"]},"malicious-packages-origins":[{"source":"kam193","sha256":"f9b8be8a4e20e24b88630f331f4bdd7bc66e208558ece25843aecc7a8110b4b4","import_time":"2026-06-23T13:28:20.42407085Z","id":"pypi/2026-06-ip-rotat/toorc","modified_time":"2026-06-23T12:07:57.927156Z","versions":["0.0.1"]},{"source":"amazon-inspector","sha256":"2cfd36909e089f17439dd3227c6f5ccef2fef2964dc26bbdbaaef0481b54615d","import_time":"2026-06-23T19:40:40.275534309Z","id":"IN-MAL-2026-007334","modified_time":"2026-06-23T18:58:00Z","versions":["0.0.1"]},{"source":"kam193","sha256":"02334bfe46d6509e7900323066c5bb2eda0d5a34a6906cee5ccca3abaecb3ade","import_time":"2026-06-24T07:47:34.503935521Z","id":"pypi/2026-06-ip-rotat/toorc","modified_time":"2026-06-23T12:07:57.927156Z","versions":["0.0.1"]}]}}