MAL-2026-11094 Malicious code in cfgzen (PyPI)

The package installs a site-wide cfgzen.pth containing import dotcfg, which Python's site machinery executes automatically at every interpreter startup — turning every python invocation on the host into a trigger for the payload. On import, dotcfg/__init__.py spawns a detached background Python subprocess (env-gated with _CFGZ_BG=1 and CREATE_NO_WINDOW on Windows) that re-imports the package and calls _native.platform_check() in the shipped Windows PyO3 extension dotcfg/_native.pyd. The native module contains: a hardcoded anonymous file-drop endpoint at files.catbox.moe/7t4wyu.*; WinHTTP and raw ws2_32 socket primitives with a spoofed Mozilla Windows User-Agent; enumeration of host identifiers (COMPUTERNAME, HOSTNAME, USERNAME, USER, LOCALAPPDATA, TEMP) staged into a file named envcorecache.dat; a CI/sandbox-evasion fingerprint enumerating 14+ build-environment variables (GITHUB_ACTIONS, GITLAB_CI, JENKINS_HOME, TRAVIS, CIRCLECI, CODEBUILD_BUILD_ID, TF_BUILD, BUILDKITE, DRONE, APPVEYOR, CI, CONTINUOUS_INTEGRATION, TEAMCITY_VERSION, HEROKU_TEST_RUN_ID); and Microsoft-mimicry staging paths (Microsoft\EdgeUpdate\EdgeUpdateService.exe, Microsoft\WindowsApps\RuntimeBroker_v2.exe, Microsoft\Edge\Temp\msedge_installer.exe, Microsoft\MediaSync\MediaSyncAgent.exe, Microsoft\Provisioning\ProvisioningHost.exe). The combination —.pth-based persistence, hidden detached subprocess, host fingerprinting, dual HTTP/socket exfil transports to an anonymous file host, CI-evasion, and Edge/Update-mimicry file names — is a Windows stealer/dropper, not a .env parser.

The malicious code sits in a native module, which is called in a few places, including the code run via PTH embedded since version 1.0.6. The native module downloads an encrypted blob and decrypt it to an executable being an infostealer.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-cfgzen

Reasons (based on the campaign):

• infostealer

• exfiltration-env-variables

• Downloads and executes a remote executable.

• obfuscation

• The package contains code to detect if it is running in a sandbox environment.

• exfiltration-crypto

• native-extension

• persistence

• abuses-pth