# MAL-2026-11428: Malicious code in wacve-utils (PyPI)


- **Type:** Malicious package
- **Package:** `wacve-utils` (PyPI)
- **Published:** 2 Aug 2026

## What is MAL-2026-11428?

MAL-2026-11428 is a malicious package in wacve-utils, published on 2 Aug 2026. 

### Official description

On `import wacve_utils`, the package's `__init__.py` unconditionally invokes `check_for_updates()`, which HTTP-fetches a hardcoded GitHub Gist under the user `Darknet-Hacker` (gist.githubusercontent.com/Darknet-Hacker/7f7e01a86e68403a457c4cd0c2d93f1d/raw/), base64-decodes the body, XORs it with a key derived from the string `wacve_utils`, zlib-decompresses it, `marshal.loads` a Python code object, and `exec`s it in-process. If the Gist fetch fails, the module falls back to shipped opaque blobs `config-linux.dat` / `config-termux.dat` (selected by a Termux/Linux platform branch) and runs them through the same base64+XOR+zlib+marshal decode-and-exec path. No pinning, no signature verification, and the payload is mutable by the Gist owner. The package advertises itself as `Lightweight utilities for chat application security checks` and exposes a stub `check_vulnerability` that returns a random boolean — a cover story unrelated to the executed payload. Importing this package grants the Gist owner arbitrary code execution in the installer's Python process.

The package contains encrypted code with infostealers targeting Linux and Android (execution under Termux). The encrypted code collects files, browsers data, text messages and exfiltrates them to a Telegram channel.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-wacve-utils

Reasons (based on the campaign):

 - files-exfiltration

 - exfiltration-browser-data

 - uses-telegram-bot

 - obfuscation

 - Downloads and executes a remote malicious script.

 - infostealer

## What should I do about MAL-2026-11428?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-11428 is a malicious package: wacve-utils (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-11428/ (Markdown: https://insights.sbomify.com/MAL-2026-11428/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-11428

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-11428/
Summaries are generated and may contain mistakes; the official description above is the record.