{"answers":{"affected":"1 open source package ship an affected version, including ig-gox.","exploited":"There is no known exploitation of MAL-2026-17712 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17712 is a malicious package in ig-gox, published on 9 Oct 2026."},"fix_prompt":"MAL-2026-17712 is a malicious package: ig-gox (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17712/ (Markdown: https://insights.sbomify.com/MAL-2026-17712/index.md)","id":"MAL-2026-17712","markdown":"https://insights.sbomify.com/MAL-2026-17712/index.md","name":"MAL-2026-17712","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Importing ig_gox runs ig_gox/__init__.py, which decodes a blob (base64, XOR, zlib) after a few anti-debugging checks and execs it as __main__. The decoded loader only goes on if it looks like a physical Android device running Termux (it turns away x86, emulators and VMs), installs requests and cryptography if they are missing, downloads encrypted code from https://goxtools.shop/api/admin/storage.php, decrypts it with AES-256-CBC and runs it in memory. The README only calls it a runtime engine for Termux. I decoded the loader statically and did not see what the downloaded code does. I read 1.0.0 and did not run it.\n\nThe pypi package ig-gox ships a top-level ig_gox/__init__.py that, on import (the README's documented usage), base64-decodes a ~5 KB embedded blob, XOR-decrypts it with a hardcoded key, zlib-decompresses it, HMAC-verifies it, then exec/compiles the resulting Python under __name__='__main__'. The visible wrapper has no other functionality; all actual behavior of the package is contained in that concealed blob. Before decoding, the module performs anti-analysis checks: it calls sys.exit(0) if sys.gettrace() returns a tracer, if the process environment/cwd/argv contain substrings such as 'uncompyle', 'pycdc', 'decompyle', 'deobfuscate', 'hook', or 'frida', and it tampers with references to builtins.exec/eval/compile. The combination of a hidden exec-of-decoded-payload reached automatically on import and explicit evasions against debuggers and decompilers is deliberate concealment of code execution from the installer and from reviewers.\n\nPackage hides obfuscated code aimed to avoid analysis and downloading the remote stage. The remote code is used to abuse Instagram service for mass fake account registration.\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\nCampaign: 2026-10-ig-gox\n\nReasons (based on the campaign):\n\n - The package contains code to detect if it is running in a sandbox environment.\n\n - obfuscation\n\n - Downloads and executes a remote malicious script.\n\n - abusing-3rd-api","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in ig-gox (PyPI)","id":"MAL-2026-17712","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"ig-gox","purl":"pkg:pypi/ig-gox","source":"MAL-2026-17712"}],"products":null,"published":"2026-10-09","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17712/"}