{"answers":{"affected":"1 open source package ship an affected version, including comp-colors.","exploited":"There is no known exploitation of MAL-2026-10986 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10986 is a malicious package in comp-colors, published on 21 Jul 2026."},"fix_prompt":"MAL-2026-10986 is a malicious package: comp-colors (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10986/ (Markdown: https://insights.sbomify.com/MAL-2026-10986/index.md)","id":"MAL-2026-10986","markdown":"https://insights.sbomify.com/MAL-2026-10986/index.md","name":"MAL-2026-10986","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package presents itself as a local color-palette toolkit but exports a public `colors()` function in remote.py that POSTs to the hardcoded endpoint https://www.fastsyncapi.com/v1/colors, writes the returned bytes to a NamedTemporaryFile with a server-controlled filename/extension, and executes them without any hash or signature verification. On Windows the code silently installs.msi responses via `msiexec.exe /i /qn /norestart` and then launches a fixed binary path; on other platforms it invokes `os.startfile` / `xdg-open` / `open` on the dropped file. A companion `update()` function collects the installer's hostname, a SHA-256 HWID derived from hostname and MAC address (`uuid.getnode()`), and locale-derived country code and POSTs them along with a caller-supplied activation key to https://www.fastsyncapi.com/v1/update; the response token is persisted at `~/.config/npm-packages/vtoken.json` (Linux) or `%LOCALAPPDATA%/npm-packages/vtoken.json` (Windows) and reused by the dropper. All classes, functions, parameters, and locals across src/pycolored/* are renamed to random tokens (e.g. `_LBOfQSgdKR5ic9eT`, `_ji0wfcMCs1P5dOqg`), and the undocumented `colors` and `update` symbols are exported in `__all__` while the README only advertises a benign `colorsv1` helper. The `npm-packages` token directory inside a Python package indicates cross-registry actor infrastructure reuse.\n\nThe package hides code to download and execute a remote executable from a newly created fastsyncapi[.]com domain. It is disguised as a remote 'fast color helper,' as opposed to the local helper, also included in the code, that only mimics any functionality. The malicious part is not immediately active: to download the binary, a key is required, which was not included in the analyzed versions. The downloaded binary is executed, and at least in one case disguised as 'AppHostRegistrationVerifier'. The package is likely prepared for multi-stage infection, but the trigger code using it was not identified.\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\nCampaign: 2026-07-colorstack\n\nReasons (based on the campaign):\n\n - Downloads and executes a remote executable.\n\n - action-hidden-in-lib-usage","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in comp-colors (PyPI)","id":"MAL-2026-10986","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"comp-colors","purl":"pkg:pypi/comp-colors","source":"MAL-2026-10986"}],"products":null,"published":"2026-07-21","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10986/"}