{"answers":{"affected":"1 open source package ship an affected version, including wacve-utils.","exploited":"There is no known exploitation of MAL-2026-11428 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-11428 is a malicious package in wacve-utils, published on 2 Aug 2026."},"fix_prompt":"MAL-2026-11428 is a malicious package: wacve-utils (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-11428/ (Markdown: https://insights.sbomify.com/MAL-2026-11428/index.md)","id":"MAL-2026-11428","markdown":"https://insights.sbomify.com/MAL-2026-11428/index.md","name":"MAL-2026-11428","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On `import wacve_utils`, the package's `__init__.py` unconditionally invokes `check_for_updates()`, which HTTP-fetches a hardcoded GitHub Gist under the user `Darknet-Hacker` (gist.githubusercontent.com/Darknet-Hacker/7f7e01a86e68403a457c4cd0c2d93f1d/raw/), base64-decodes the body, XORs it with a key derived from the string `wacve_utils`, zlib-decompresses it, `marshal.loads` a Python code object, and `exec`s it in-process. If the Gist fetch fails, the module falls back to shipped opaque blobs `config-linux.dat` / `config-termux.dat` (selected by a Termux/Linux platform branch) and runs them through the same base64+XOR+zlib+marshal decode-and-exec path. No pinning, no signature verification, and the payload is mutable by the Gist owner. The package advertises itself as `Lightweight utilities for chat application security checks` and exposes a stub `check_vulnerability` that returns a random boolean — a cover story unrelated to the executed payload. Importing this package grants the Gist owner arbitrary code execution in the installer's Python process.\n\nThe package contains encrypted code with infostealers targeting Linux and Android (execution under Termux). The encrypted code collects files, browsers data, text messages and exfiltrates them to a Telegram channel.\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\nCampaign: 2026-08-wacve-utils\n\nReasons (based on the campaign):\n\n - files-exfiltration\n\n - exfiltration-browser-data\n\n - uses-telegram-bot\n\n - obfuscation\n\n - Downloads and executes a remote malicious script.\n\n - infostealer","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in wacve-utils (PyPI)","id":"MAL-2026-11428","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"wacve-utils","purl":"pkg:pypi/wacve-utils","source":"MAL-2026-11428"}],"products":null,"published":"2026-08-02","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-11428/"}