MAL-2026-17877 Malicious code in saeka (PyPI)

When a user invokes the card-checking feature, saeka sends the supplied card number, expiration month and year, and CVV as a single value to https://uncoder.eu.org/cc-checker/api.php using an HTTP POST. The package description does not disclose this external recipient or the transfer of complete card credentials. Versions 8.0 through 15.0 listed below contain this behavior. The request requires use of the checking feature; installation or import alone does not trigger it. Version 15.0 also includes bulk card checking and a Shopify checkout flow. The recipient's ownership, retention of submitted data, and any actual unauthorized transactions have not been established.

The saeka CLI provisions an Xray multi-protocol proxy (VLESS/VMess/Trojan/Shadowsocks with hardcoded password/id 'saeka') on the installer's own GCP Cloud Run account with –allow-unauthenticated public exposure. setup.sh fetches a live GitHub Personal Access Token from https://pastebin.com/raw/7rAmCXDp, stores it at ~/.gh_token, then git-clones github.com/qkc404/saeka-gcp-panel, appends the installer's newly-deployed Cloud Run hostname to host.txt, and git-pushes the change back to the author's repository - silently enrolling every installer's deployed proxy hostname in an author-maintained inventory with no disclosure (README is empty). setup.sh additionally fetches config.json from the mutable raw.githubusercontent.com/qkc404/saeka-gcp-panel/main branch and Xray-linux-64.zip from the XTLS/Xray-core 'latest' release, baking both unpinned artifacts into the container image built and run in the installer's GCP project. The Pastebin-hosted token authorizes writes to the author's own repository, so the credential blast radius is confined to the author, but any change to the mutable config/binary sources subsequently executes on installer-funded cloud infrastructure whose access parameters (hardcoded 'saeka' credential + inventoried hostname) are known to the author.

The package is a mass credit card checker: it checks if credit card data are real and active by abusing real online retail services.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-saeka

Reasons (based on the campaign):

• abusing-3rd-api