MAL-2026-10991 Malicious code in make-helper (PyPI)

On import dev_helper, the package's init.py starts a daemon thread that runs decryptor.decrypt_and_run(): it fetches an AES-GCM key from the hardcoded endpoint https://key-2qfm.vercel.app/api/key, decrypts the shipped dev_helper/encrypted.bin (16.9 KB ciphertext, nonce prepended), and executes the plaintext via exec(plaintext, {'name': 'main'}). The auto-start is gated to skip interactive Python sessions and PYTHONSTARTUP contexts, so the payload fires in CI and production imports but stays hidden from REPL inspection. Logging is disabled (logging.disable(logging.CRITICAL)) and errors are swallowed. The package's stated purpose ("a helpful developer utility") does not disclose any of this, and the true payload is opaque without the remote key, allowing the operator of key-2qfm.vercel.app to rotate the executed code at will.

The package embeds encrypted code that, during import, is decrypted using an externally sourced password. The recovered code is executed and starts a bot capable of exfiltrating local files.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-make-helper

Reasons (based on the campaign):

• files-exfiltration

• obfuscation

• uses-telegram-bot