# MAL-2026-10919: Malicious code in ml-core-airflow-auth (PyPI)


- **Type:** Malicious package
- **Package:** `ml-core-airflow-auth` (PyPI)
- **Published:** 20 Jul 2026

## What is MAL-2026-10919?

MAL-2026-10919 is a malicious package in ml-core-airflow-auth, published on 20 Jul 2026. 

### Official description

The package advertises itself as an 'auth token handler' but its public API (src/ml_core_airflow_auth/__init__.py) exposes only a trivial in-memory TokenStore stub unrelated to the ~3300 LOC of hidden telemetry code shipped alongside. The setup.py custom install command copies telemetry.pth into site-packages; that.pth file contains `import _telemetry_init`, causing every subsequent Python interpreter start on the host to auto-load _telemetry_init._bootstrap, which spawns a daemon thread that constructs an analytics Client (Envelope, HttpTransport, ServiceDiscovery, DataScrubber, SessionTracker) and calls client.track('session_start') with the machine's hostname, OS, Python version, and cpu_count. The reporting endpoint is not a static URL; _telemetry_transport.py's ServiceDiscovery opens a raw UDP DNS socket with hardcoded fallback resolvers 8.8.8.8 and 1.1.1.1, queries TXT records under `0.<domain>`... `N.<domain>`, and reconstructs the destination via `base64.b64decode(''.join(segments))`, letting the operator change the exfiltration destination post-install without republishing. The name, generic 'Platform Engineering' author, and mismatch between the declared purpose and the hidden persistent telemetry framework are consistent with dependency-confusion targeting corporate ML/Airflow environments.

Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from one of c.*.dl.well1[.]site domains, depending on the system. This record returns a number, which is then used to iterate over domains in the form <0...n>.*.dl.well1[.]site and reconstruct the encoded executable from their TXT records. The downloaded binary is then executed and removed afterward. Using a PTH file ensures persistence and runs on every Python start. In this campaign, versions 0.0.1 hold disarmed code (without the necessary configuration), which is completed in further updates.

This is a continuation of the 2026-07-haproxy-config-client campaign.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-andreiiiiiii_i

Reasons (based on the campaign):

 - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

 - The package overrides the install command in setup.py to execute malicious code during installation.

 - Downloads and executes a remote executable.

 - covering-tracks

 - persistence

 - abuses-pth

 - data-stored-in-dns

## What should I do about MAL-2026-10919?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-10919 is a malicious package: ml-core-airflow-auth (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-10919/ (Markdown: https://insights.sbomify.com/MAL-2026-10919/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-10919

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-10919/
Summaries are generated and may contain mistakes; the official description above is the record.