# MAL-2026-14389: Malicious code in envprovision (PyPI)


- **Type:** Malicious package
- **Package:** `envprovision` (PyPI)
- **Published:** 23 Aug 2026

## What is MAL-2026-14389?

MAL-2026-14389 is a malicious package in envprovision, published on 23 Aug 2026. 

### Official description

envprovision 1.4.0 presents itself as an environment-diagnostics helper but its public `check()`/`sync()` API, on Windows, fetches a JSON manifest from a base64-obfuscated URL that decodes to https://env-metadata.up.railway.app/vbv_a8F3kL92xQ/manifest.json, downloads the referenced binary to a temp path, and executes it. TLS verification is disabled on both the manifest fetch and the binary download (ctx.check_hostname=False, ctx.verify_mode=ssl.CERT_NONE), so the payload can also be substituted by any on-path attacker. The dropped binary is invoked with NSIS silent-install flags (`/S`, `/NCRC`) built by character-list concatenation and hidden-window creation flags, then a follow-on `syshelpear.exe` is spawned detached (CREATE_NO_WINDOW|DETACHED_PROCESS) from a user-writable ProgramFiles/LOCALAPPDATA location as a persistence helper. After execution, `wevtutil cl Application` and `wevtutil cl System` are invoked to erase Windows event logs. The endpoint obfuscation, TLS-off fetch-and-execute of an opaque binary from a publisher-mismatched Railway subdomain, silent-install flag assembly, detached helper launch, and anti-forensic log clearing are inconsistent with the advertised diagnostics purpose and constitute an installer-side binary dropper with persistence.

Exported functions hide the malicious functionality. On Windows, it downloads and installs a malicious executable, and disguises it as a system utility. After installation, the code attempts to cover its tracks by cleaning logs and removing downloaded files. The installed executable is a heavily obfuscated malware with multiple sandbox evasion techniques, finally running an infostealer identifying itself as "Snow Stealer". It collects at least browser data and modifies cryptowallet applications.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-envprovision

Reasons (based on the campaign):

 - Downloads and executes a remote executable.

 - action-hidden-in-lib-usage

 - covering-tracks

 - persistence

 - The package contains code to detect if it is running in a sandbox environment.

 - obfuscation

 - malware

 - infostealer

 - exfiltration-browser-data

 - exfiltration-crypto

## What should I do about MAL-2026-14389?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-14389 is a malicious package: envprovision (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-14389/ (Markdown: https://insights.sbomify.com/MAL-2026-14389/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-14389

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-14389/
Summaries are generated and may contain mistakes; the official description above is the record.