# MAL-2026-10689: Malicious code in pylogora (PyPI)


- **Type:** Malicious package
- **Package:** `pylogora` (PyPI)
- **Published:** 15 Jul 2026

## What is MAL-2026-10689?

MAL-2026-10689 is a malicious package in pylogora, published on 15 Jul 2026. 

### Official description

pylogora/__init__.py invokes _a() at module top level, so any `import pylogora` triggers the payload. _a() base64-decodes hidden URLs and filesystem paths, branches on OS and CPU architecture, downloads a native binary from easyswasnow.pro (Linux amd/arm and macOS amd/arm variants under /downloads/) or from a Google Drive file (Windows, id 1d4zF8lnDaYCgzRrEx3WCyLTFZXVD2QBF), writes it to a hidden staging path (~/.local/share/config on Linux, /Users/Shared/.local/config on macOS, %TEMP%\t.jse run via cscript on Windows), chmods it executable, strips the macOS quarantine attribute via xattr, and executes it. It then installs persistence: a systemd user unit at ~/.config/systemd/user/python-script.service enabled with `systemctl --user enable --now`, or a LaunchAgent at ~/Library/LaunchAgents/com.user.script.plist loaded with `launchctl load -dw`, causing the package's __file__ to re-execute on every login. All URLs, destination paths, unit/plist bodies, argv strings, and the User-Agent are base64-encoded and decoded through a _b() helper to conceal intent. The declared purpose is a logging library, which has no need to fetch or execute native binaries from an anonymous host.

The typosquatted package installs a Mythic/Poseidon C2 framework beacon and ensures persistence. After installation, the beacon communicates with C2 on wegoexchange[.]site for further commands.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-tennacity

Reasons (based on the campaign):

 - typosquatting

 - Downloads and executes a remote executable.

 - The package contains code to detect if it is running in a sandbox environment.

 - malware

 - persistence

## What should I do about MAL-2026-10689?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-10689 is a malicious package: pylogora (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-10689/ (Markdown: https://insights.sbomify.com/MAL-2026-10689/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-10689

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-10689/
Summaries are generated and may contain mistakes; the official description above is the record.