{"answers":{"affected":"1 open source package ship an affected version, including seapy-ops.","exploited":"There is no known exploitation of MAL-2026-17880 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17880 is a malicious package in seapy-ops, published on 29 Oct 2026."},"fix_prompt":"MAL-2026-17880 is a malicious package: seapy-ops (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17880/ (Markdown: https://insights.sbomify.com/MAL-2026-17880/index.md)","id":"MAL-2026-17880","markdown":"https://insights.sbomify.com/MAL-2026-17880/index.md","name":"MAL-2026-17880","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden prompt command also uploads the folder before sending the first prompt. File symlinks can expose content outside that directory. Server-supplied result paths additionally allow files to be written outside the working directory.\n\nVersions 1.2.1 and 1.2.2 instead present a Python REPL that silently sends eligible single-token input to the server as an unlock password, subject to filtering and attempt limits. Other commands, excluding local help, version, unlock, configuration, and uninstall paths, can fetch Base64-encoded, gzip-compressed code, execute it in memory, and call its main function. Loader errors are disguised as Python file-not-found errors.\n\nThe malicious assessment is based on concealed file transmission in the earlier releases and interpreter impersonation, concealed input transmission, remote execution, and failure concealment in the later releases. Official distributions were verified against PyPI digests. Isolated, network-disabled tests across all eight listed versions confirmed the relevant data flows using synthetic credentials and mocked server responses, including symlink-target uploads, writes outside the working directory, REPL input transmission, and execution of a synthetic payload. No live endpoint was contacted; the actual server-supplied payload remains unknown.\n\nseapy-ops presents itself in its README as a stdlib-only local file inspection tool (strings/sum/steg/crypto/hints/scan), but cli.py implements undocumented subcommands (-s, -p, -st, -sd, config, uninstall) gated behind a hardcoded salted-SHA256 password (PW_HASH=aa65f53e3bea9f2d908fefbb5d6c8804f2fc11f6135f03ed9234fed4def7f590). Once unlocked, these subcommands communicate with a hardcoded author-controlled server at https://b196q82k8891-d.space-z.ai (fallback https://preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai, overridable via SEAPY_SERVER). cmd_send_all / cmd_send_prompt / cmd_push_discord invoke collect_files(), which recursively walks the user's current working directory (skipping only.git/__pycache__/node_modules/.venv/venv/.svn and dotfiles, with a 4MB per-file cap) and POSTs the contents as multipart to /api/cli/upload keyed by an apiKey obtained via /api/cli/init — exfiltrating source code, local assets, and any environment or credential files in the workspace. cmd_status polls /api/cli/download and writes every server-returned entry (base64-decoded) into a subdirectory of os.getcwd(), giving the remote operator full control over filenames and contents placed inside the installer's project tree; additional endpoints /api/cli/prompt, /api/cli/push, and /api/cli/pull extend the bidirectional channel. load_config() silently migrates configuration from ~/.verity, ~/.fpeek, and ~/.pythom, indicating the same covert-channel code has been re-published under multiple package names. The combination of a cover-story README, undocumented password-gated flags, bulk workspace upload to a hardcoded endpoint, and attacker-controlled file writes into CWD is a hidden backdoor and active data exfiltration channel, not the local-only utility the package advertises.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in seapy-ops (PyPI)","id":"MAL-2026-17880","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"seapy-ops","purl":"pkg:pypi/seapy-ops","source":"MAL-2026-17880"}],"products":null,"published":"2026-10-29","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17880/"}