MAL-2026-10976 Malicious code in colorstack (PyPI)

The package publishes as 'colorstack' with a summary advertising a color/gradient library, but installs under the import name 'newcolors' and exposes two functions unrelated to color generation. The exported colors() function POSTs to the hardcoded endpoint https://www.fastsyncapi.com/v1/colors, writes the response body to a temporary file preserving the server-supplied filename extension, and dispatches it through the OS via os.startfile on Windows or subprocess.run with open/xdg-open on macOS/Linux. Because the remote server chooses both the filename and the bytes, extensions such as.exe/.bat/.ps1/.lnk on Windows or.command/.desktop/.app handlers on macOS/Linux are executed by the OS shell, giving the operator of fastsyncapi.com arbitrary code execution on any host that calls colors(). A second function, update(activation_key), collects the installer's hostname, locale-derived country code, and a SHA-256 device hash derived from the hostname and the MAC address returned by uuid.getnode(), and POSTs those fields together with the activation key to https://www.fastsyncapi.com/v1/update; the response token is persisted to ~/.config/newcolors/vtoken.json. The hostname+MAC-derived HWID is a stable per-host fingerprint that lets the operator uniquely identify installers and select per-host payloads through the colors() channel. The fastsyncapi.com domain has no relation to a color library, and the package name/summary/README serve as a cover story for this fetch-and-execute and fingerprinting behavior.

The package hides code to download and execute a remote executable from a newly created fastsyncapi[.]com domain. It is disguised as a remote 'fast color helper,' as opposed to the local helper, also included in the code, that only mimics any functionality. The malicious part is not immediately active: to download the binary, a key is required, which was not included in the analyzed versions. The downloaded binary is executed, and at least in one case disguised as 'AppHostRegistrationVerifier'. The package is likely prepared for multi-stage infection, but the trigger code using it was not identified.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-colorstack

Reasons (based on the campaign):

• Downloads and executes a remote executable.

• action-hidden-in-lib-usage