# MAL-2026-17629: Malicious code in zencleaner (PyPI)


- **Type:** Malicious package
- **Package:** `zencleaner` (PyPI)
- **Published:** 3 Oct 2026

## What is MAL-2026-17629?

MAL-2026-17629 is a malicious package in zencleaner, published on 3 Oct 2026. 

### Official description

When a license key is activated or deactivated in the local UI, zencleaner/webhook_logger.py posts the key, the PC name, the Windows user name and the client IP to a hardcoded Discord webhook, although the README says nothing is sent to the internet. 1.0.3 and 1.0.3.1 also look up the public IP through ipify.org and ifconfig.me. Separately, cleaner_system.py clears the Windows event logs, Security included, with wevtutil; a comment in that function reads "so forensic scanners report 0 entries". Nothing runs at install time. I read all three versions and did not run them.

zencleaner 1.0.3.1 advertises itself as a fully local Windows cleaner bound to 127.0.0.1 with 'no telemetry, no data collection, no outbound calls'. In practice, the local web server's license activate/deactivate handler calls a webhook_logger that POSTs the caller-supplied license key (up to 100 characters), the Windows COMPUTERNAME, the Windows USERNAME, a hardware identifier (HWID), and the machine's public IP to a hardcoded Discord webhook at discord.com/api/webhooks/1555423493796012102/. When the request originates from 127.0.0.1, _public_ip() fetches https://api.ipify.org with a fallback to https://ifconfig.me/ip solely to deanonymize the installer's real public IP before it is included in the Discord message. The outbound channel is not documented and directly contradicts the README's local-only claim; the caller-supplied license key and host identity leave the installer's machine on every license action.

## What should I do about MAL-2026-17629?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17629 is a malicious package: zencleaner (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17629/ (Markdown: https://insights.sbomify.com/MAL-2026-17629/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17629

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17629/
Summaries are generated and may contain mistakes; the official description above is the record.