MAL-2026-17880 Malicious code in seapy-ops (PyPI)

In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden prompt command also uploads the folder before sending the first prompt. File symlinks can expose content outside that directory. Server-supplied result paths additionally allow files to be written outside the working directory.

Versions 1.2.1 and 1.2.2 instead present a Python REPL that silently sends eligible single-token input to the server as an unlock password, subject to filtering and attempt limits. Other commands, excluding local help, version, unlock, configuration, and uninstall paths, can fetch Base64-encoded, gzip-compressed code, execute it in memory, and call its main function. Loader errors are disguised as Python file-not-found errors.

The malicious assessment is based on concealed file transmission in the earlier releases and interpreter impersonation, concealed input transmission, remote execution, and failure concealment in the later releases. Official distributions were verified against PyPI digests. Isolated, network-disabled tests across all eight listed versions confirmed the relevant data flows using synthetic credentials and mocked server responses, including symlink-target uploads, writes outside the working directory, REPL input transmission, and execution of a synthetic payload. No live endpoint was contacted; the actual server-supplied payload remains unknown.

seapy-ops presents itself in its README as a stdlib-only local file inspection tool (strings/sum/steg/crypto/hints/scan), but cli.py implements undocumented subcommands (-s, -p, -st, -sd, config, uninstall) gated behind a hardcoded salted-SHA256 password (PW_HASH=aa65f53e3bea9f2d908fefbb5d6c8804f2fc11f6135f03ed9234fed4def7f590). Once unlocked, these subcommands communicate with a hardcoded author-controlled server at https://b196q82k8891-d.space-z.ai (fallback https://preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai, overridable via SEAPY_SERVER). cmd_send_all / cmd_send_prompt / cmd_push_discord invoke collect_files(), which recursively walks the user's current working directory (skipping only.git/pycache/node_modules/.venv/venv/.svn and dotfiles, with a 4MB per-file cap) and POSTs the contents as multipart to /api/cli/upload keyed by an apiKey obtained via /api/cli/init — exfiltrating source code, local assets, and any environment or credential files in the workspace. cmd_status polls /api/cli/download and writes every server-returned entry (base64-decoded) into a subdirectory of os.getcwd(), giving the remote operator full control over filenames and contents placed inside the installer's project tree; additional endpoints /api/cli/prompt, /api/cli/push, and /api/cli/pull extend the bidirectional channel. load_config() silently migrates configuration from ~/.verity, ~/.fpeek, and ~/.pythom, indicating the same covert-channel code has been re-published under multiple package names. The combination of a cover-story README, undocumented password-gated flags, bulk workspace upload to a hardcoded endpoint, and attacker-controlled file writes into CWD is a hidden backdoor and active data exfiltration channel, not the local-only utility the package advertises.