{"answers":{"affected":"1 open source package ship an affected version, including saeka.","exploited":"There is no known exploitation of MAL-2026-17877 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17877 is a malicious package in saeka, published on 14 Oct 2026."},"fix_prompt":"MAL-2026-17877 is a malicious package: saeka (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17877/ (Markdown: https://insights.sbomify.com/MAL-2026-17877/index.md)","id":"MAL-2026-17877","markdown":"https://insights.sbomify.com/MAL-2026-17877/index.md","name":"MAL-2026-17877","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"When a user invokes the card-checking feature, saeka sends the supplied card number, expiration month and year, and CVV as a single value to https://uncoder.eu.org/cc-checker/api.php using an HTTP POST. The package description does not disclose this external recipient or the transfer of complete card credentials. Versions 8.0 through 15.0 listed below contain this behavior. The request requires use of the checking feature; installation or import alone does not trigger it. Version 15.0 also includes bulk card checking and a Shopify checkout flow. The recipient's ownership, retention of submitted data, and any actual unauthorized transactions have not been established.\n\nThe saeka CLI provisions an Xray multi-protocol proxy (VLESS/VMess/Trojan/Shadowsocks with hardcoded password/id 'saeka') on the installer's own GCP Cloud Run account with --allow-unauthenticated public exposure. setup.sh fetches a live GitHub Personal Access Token from https://pastebin.com/raw/7rAmCXDp, stores it at ~/.gh_token, then git-clones github.com/qkc404/saeka-gcp-panel, appends the installer's newly-deployed Cloud Run hostname to host.txt, and git-pushes the change back to the author's repository - silently enrolling every installer's deployed proxy hostname in an author-maintained inventory with no disclosure (README is empty). setup.sh additionally fetches config.json from the mutable raw.githubusercontent.com/qkc404/saeka-gcp-panel/main branch and Xray-linux-64.zip from the XTLS/Xray-core 'latest' release, baking both unpinned artifacts into the container image built and run in the installer's GCP project. The Pastebin-hosted token authorizes writes to the author's own repository, so the credential blast radius is confined to the author, but any change to the mutable config/binary sources subsequently executes on installer-funded cloud infrastructure whose access parameters (hardcoded 'saeka' credential + inventoried hostname) are known to the author.\n\nThe package is a mass credit card checker: it checks if credit card data are real and active by abusing real online retail services.\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\nCampaign: 2026-10-saeka\n\nReasons (based on the campaign):\n\n - abusing-3rd-api","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in saeka (PyPI)","id":"MAL-2026-17877","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"saeka","purl":"pkg:pypi/saeka","source":"MAL-2026-17877"}],"products":null,"published":"2026-10-14","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17877/"}