# MAL-2026-17712: Malicious code in ig-gox (PyPI)


- **Type:** Malicious package
- **Package:** `ig-gox` (PyPI)
- **Published:** 9 Oct 2026

## What is MAL-2026-17712?

MAL-2026-17712 is a malicious package in ig-gox, published on 9 Oct 2026. 

### Official description

Importing ig_gox runs ig_gox/__init__.py, which decodes a blob (base64, XOR, zlib) after a few anti-debugging checks and execs it as __main__. The decoded loader only goes on if it looks like a physical Android device running Termux (it turns away x86, emulators and VMs), installs requests and cryptography if they are missing, downloads encrypted code from https://goxtools.shop/api/admin/storage.php, decrypts it with AES-256-CBC and runs it in memory. The README only calls it a runtime engine for Termux. I decoded the loader statically and did not see what the downloaded code does. I read 1.0.0 and did not run it.

The pypi package ig-gox ships a top-level ig_gox/__init__.py that, on import (the README's documented usage), base64-decodes a ~5 KB embedded blob, XOR-decrypts it with a hardcoded key, zlib-decompresses it, HMAC-verifies it, then exec/compiles the resulting Python under __name__='__main__'. The visible wrapper has no other functionality; all actual behavior of the package is contained in that concealed blob. Before decoding, the module performs anti-analysis checks: it calls sys.exit(0) if sys.gettrace() returns a tracer, if the process environment/cwd/argv contain substrings such as 'uncompyle', 'pycdc', 'decompyle', 'deobfuscate', 'hook', or 'frida', and it tampers with references to builtins.exec/eval/compile. The combination of a hidden exec-of-decoded-payload reached automatically on import and explicit evasions against debuggers and decompilers is deliberate concealment of code execution from the installer and from reviewers.

Package hides obfuscated code aimed to avoid analysis and downloading the remote stage. The remote code is used to abuse Instagram service for mass fake account registration.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-ig-gox

Reasons (based on the campaign):

 - The package contains code to detect if it is running in a sandbox environment.

 - obfuscation

 - Downloads and executes a remote malicious script.

 - abusing-3rd-api

## What should I do about MAL-2026-17712?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17712 is a malicious package: ig-gox (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17712/ (Markdown: https://insights.sbomify.com/MAL-2026-17712/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17712

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17712/
Summaries are generated and may contain mistakes; the official description above is the record.