MAL-2026-10974 Malicious code in rasterkit (PyPI)

The rasterkit 1.0.2 distribution installs its modules under the top-level PIL/ package name owned by Pillow. top_level.txt declares PIL and the wheel's RECORD places PIL/__init__.py, PIL/Image.py, PIL/_binary.py, and related files under this publisher's control, so an environment that installs rasterkit alongside or in place of Pillow will resolve from PIL import Image to code shipped by rasterkit. In addition, PIL/_binary.py defines a bmp_plane_tail function that walks the trailing pixels of a bundled 24-bpp bitmap at PIL/_data/demo.bmp (~2.3 MB), reads one byte per pixel, XORs each byte with a caller-supplied key, and returns the concatenated buffer optionally split into segments. PIL/_data/__init__.py hardcodes exact reconstruction parameters (DEMO_TAIL_COUNT=5092, DEMO_TAIL_MIX=42, DEMO_TAIL_SEGMENTS=[3379,1713]) that recover two specific hidden buffers from the bundled BMP. No code path in this version invokes the decoder at install or import time, and no exec/compile/__import__ sink for the recovered bytes is present in the shipped files, so there is no traced auto-execution of the hidden payload. The combination — namespace occupation of Pillow's PIL plus a stego decoder with fixed parameters over a bundled carrier — matches the shape of a two-stage dropper staging component where a separate module would supply the execution sink.

This package is a clone of Pillow library with malicious code hidden in an image using steganography. The code is the used in a dependant package to install an SSH backdoor.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-textwrap-toolkit-stager

Reasons (based on the campaign):

• backdoor

• obfuscation

• crypto-related

• Downloads and executes a remote malicious script.

• exfiltration-crypto