{"answers":{"affected":"1 open source package ship an affected version, including dwh-kafka-client.","exploited":"There is no known exploitation of MAL-2026-10915 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10915 is a malicious package in dwh-kafka-client, published on 17 Jul 2026."},"fix_prompt":"MAL-2026-10915 is a malicious package: dwh-kafka-client (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10915/ (Markdown: https://insights.sbomify.com/MAL-2026-10915/index.md)","id":"MAL-2026-10915","markdown":"https://insights.sbomify.com/MAL-2026-10915/index.md","name":"MAL-2026-10915","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The pypi package `dwh-kafka-client` 0.0.1 presents itself as a Kafka client but ships no Kafka functionality — the advertised `DwhKafkaClient` class in `src/dwh_kafka_client/__init__.py` is a placeholder with only `_opts`/`init`/`configure` stubs. The real payload is a persistence + phone-home mechanism: `setup.py` overrides the install command (`_Install.run`) to explicitly `shutil.copy2` a `telemetry.pth` file into `self.install_lib` or `site.getsitepackages()[0]`, guaranteeing placement into site-packages. The `.pth` file contains `import _telemetry_init`, which Python auto-executes at every interpreter startup regardless of whether `dwh_kafka_client` is ever imported. `_telemetry_init` spawns a daemon thread that instantiates a `Client` and calls `track('session_start')`, transmitting a session ID derived from hostname/pid/monotonic time along with host metadata (`platform.node()`, OS, `os.cpu_count()`, Python version) to a runtime-discovered destination. The destination is not present in the source: `_telemetry_transport.py`'s `ServiceDiscovery` performs raw UDP DNS TXT lookups for numbered segments (`0.\u003cdomain\u003e`, `N.\u003cdomain\u003e`), concatenates them, and base64-decodes the result to reconstruct the endpoint at runtime, with hardcoded fallback to public resolvers 8.8.8.8 and 1.1.1.1 to bypass corporate DNS filtering. The shipped `_CDN_MIRRORS`, `_PLATFORM_ASSETS`, and `_FALLBACK_RESOLVERS` config maps are empty, ensuring the live C2 host is not statically visible. The internal-sounding name, placeholder metadata, and hollow advertised functionality are consistent with a dependency-confusion lure targeting organizations with an internal `dwh-kafka-client` package.\n\nPackage presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from one of c.*.dl.well1[.]site domains, depending on the system. This record returns a number, which is then used to iterate over domains in the form \u003c0...n\u003e.*.dl.well1[.]site and reconstruct the encoded executable from their TXT records. The downloaded binary is then executed and removed afterward. Using a PTH file ensures persistence and runs on every Python start. In this campaign, versions 0.0.1 hold disarmed code (without the necessary configuration), which is completed in further updates.\n\nThis is a continuation of the 2026-07-haproxy-config-client campaign.\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\nCampaign: 2026-07-andreiiiiiii_i\n\nReasons (based on the campaign):\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n - Downloads and executes a remote executable.\n\n - covering-tracks\n\n - persistence\n\n - abuses-pth\n\n - data-stored-in-dns","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in dwh-kafka-client (PyPI)","id":"MAL-2026-10915","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"dwh-kafka-client","purl":"pkg:pypi/dwh-kafka-client","source":"MAL-2026-10915"}],"products":null,"published":"2026-07-17","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10915/"}