# MAL-2026-11094: Malicious code in cfgzen (PyPI)


- **Type:** Malicious package
- **Package:** `cfgzen` (PyPI)
- **Published:** 27 Jul 2026

## What is MAL-2026-11094?

MAL-2026-11094 is a malicious package in cfgzen, published on 27 Jul 2026. 

### Official description

The package installs a site-wide `cfgzen.pth` containing `import dotcfg`, which Python's site machinery executes automatically at every interpreter startup — turning every `python` invocation on the host into a trigger for the payload. On import, `dotcfg/__init__.py` spawns a detached background Python subprocess (env-gated with `_CFGZ_BG=1` and `CREATE_NO_WINDOW` on Windows) that re-imports the package and calls `_native.platform_check()` in the shipped Windows PyO3 extension `dotcfg/_native.pyd`. The native module contains: a hardcoded anonymous file-drop endpoint at `files.catbox.moe/7t4wyu.*`; WinHTTP and raw ws2_32 socket primitives with a spoofed Mozilla Windows User-Agent; enumeration of host identifiers (`COMPUTERNAME`, `HOSTNAME`, `USERNAME`, `USER`, `LOCALAPPDATA`, `TEMP`) staged into a file named `envcorecache.dat`; a CI/sandbox-evasion fingerprint enumerating 14+ build-environment variables (`GITHUB_ACTIONS`, `GITLAB_CI`, `JENKINS_HOME`, `TRAVIS`, `CIRCLECI`, `CODEBUILD_BUILD_ID`, `TF_BUILD`, `BUILDKITE`, `DRONE`, `APPVEYOR`, `CI`, `CONTINUOUS_INTEGRATION`, `TEAMCITY_VERSION`, `HEROKU_TEST_RUN_ID`); and Microsoft-mimicry staging paths (`Microsoft\EdgeUpdate\EdgeUpdateService.exe`, `Microsoft\WindowsApps\RuntimeBroker_v2.exe`, `Microsoft\Edge\Temp\msedge_installer.exe`, `Microsoft\MediaSync\MediaSyncAgent.exe`, `Microsoft\Provisioning\ProvisioningHost.exe`). The combination —.pth-based persistence, hidden detached subprocess, host fingerprinting, dual HTTP/socket exfil transports to an anonymous file host, CI-evasion, and Edge/Update-mimicry file names — is a Windows stealer/dropper, not a `.env` parser.

The malicious code sits in a native module, which is called in a few places, including the code run via PTH embedded since version 1.0.6. The native module downloads an encrypted blob and decrypt it to an executable being an infostealer.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-cfgzen

Reasons (based on the campaign):

 - infostealer

 - exfiltration-env-variables

 - Downloads and executes a remote executable.

 - obfuscation

 - The package contains code to detect if it is running in a sandbox environment.

 - exfiltration-crypto

 - native-extension

 - persistence

 - abuses-pth

## What should I do about MAL-2026-11094?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-11094 is a malicious package: cfgzen (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-11094/ (Markdown: https://insights.sbomify.com/MAL-2026-11094/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-11094

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-11094/
Summaries are generated and may contain mistakes; the official description above is the record.