# MAL-2026-10986: Malicious code in comp-colors (PyPI)


- **Type:** Malicious package
- **Package:** `comp-colors` (PyPI)
- **Published:** 21 Jul 2026

## What is MAL-2026-10986?

MAL-2026-10986 is a malicious package in comp-colors, published on 21 Jul 2026. 

### Official description

The package presents itself as a local color-palette toolkit but exports a public `colors()` function in remote.py that POSTs to the hardcoded endpoint https://www.fastsyncapi.com/v1/colors, writes the returned bytes to a NamedTemporaryFile with a server-controlled filename/extension, and executes them without any hash or signature verification. On Windows the code silently installs.msi responses via `msiexec.exe /i /qn /norestart` and then launches a fixed binary path; on other platforms it invokes `os.startfile` / `xdg-open` / `open` on the dropped file. A companion `update()` function collects the installer's hostname, a SHA-256 HWID derived from hostname and MAC address (`uuid.getnode()`), and locale-derived country code and POSTs them along with a caller-supplied activation key to https://www.fastsyncapi.com/v1/update; the response token is persisted at `~/.config/npm-packages/vtoken.json` (Linux) or `%LOCALAPPDATA%/npm-packages/vtoken.json` (Windows) and reused by the dropper. All classes, functions, parameters, and locals across src/pycolored/* are renamed to random tokens (e.g. `_LBOfQSgdKR5ic9eT`, `_ji0wfcMCs1P5dOqg`), and the undocumented `colors` and `update` symbols are exported in `__all__` while the README only advertises a benign `colorsv1` helper. The `npm-packages` token directory inside a Python package indicates cross-registry actor infrastructure reuse.

The package hides code to download and execute a remote executable from a newly created fastsyncapi[.]com domain. It is disguised as a remote 'fast color helper,' as opposed to the local helper, also included in the code, that only mimics any functionality. The malicious part is not immediately active: to download the binary, a key is required, which was not included in the analyzed versions. The downloaded binary is executed, and at least in one case disguised as 'AppHostRegistrationVerifier'. The package is likely prepared for multi-stage infection, but the trigger code using it was not identified.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-colorstack

Reasons (based on the campaign):

 - Downloads and executes a remote executable.

 - action-hidden-in-lib-usage

## What should I do about MAL-2026-10986?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-10986 is a malicious package: comp-colors (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-10986/ (Markdown: https://insights.sbomify.com/MAL-2026-10986/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-10986

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-10986/
Summaries are generated and may contain mistakes; the official description above is the record.