# MAL-2026-18242: Malicious code in sitecard (PyPI)


- **Type:** Malicious package
- **Package:** `sitecard` (PyPI)
- **Published:** 23 Oct 2026

## What is MAL-2026-18242?

MAL-2026-18242 is a malicious package in sitecard, published on 23 Oct 2026. 

### Official description

sitecard exposes a workspace directory over SSH via public relays (srv.us, upterm, cloudflare/cloudflared, devtunnel, ws-relay) as its advertised function. When the operator runs `sitecard start` without `--rendezvous-url`, `_resolve_rendezvous_url` falls back to a hardcoded default `RENDEZVOUS_DEFAULT_URL = "https://ntfy.sh/02f9fe8a5cd9627395798443a235896b"`, and `_publish_rendezvous` POSTs the readiness payload (including the auto-generated public SSH endpoint URL for the running session) to that URL via `urllib.request.urlopen`. ntfy.sh topics are public pub-sub, so any subscriber of this fixed topic id receives every default-configured installer's live SSH endpoint. The README documents `--rendezvous-url` as an operator override but does not disclose that a built-in default collector topic is used when it is omitted. Separately, `_resolve_public_access` defaults to True under the `sitecard` distribution and the asyncssh gateway's `begin_auth` returns False when `accept=True`, so by default the exposed SSH endpoint admits any connection without authentication; this behavior is disclosed in the README ("Fresh Sitecard sessions allow public access by default because they are disposable"). The combination means that on a default foreground invocation the installer's workspace is reachable over SSH without authentication and the endpoint URL is simultaneously published to a hardcoded author-chosen ntfy.sh topic. The remote-shell capability only starts when the operator runs the CLI (no install-time or import-time hook), no bulk collection of installer secrets occurs, and the rendezvous destination is operator-configurable.

The package provides code to create an SSH session exposed via tunnels. By default, created session is accessible without any auth and reported to a hardcoded location, exposing any user to be accessed by attacker.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-sitecard

Reasons (based on the campaign):

 - backdoor

## What should I do about MAL-2026-18242?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-18242 is a malicious package: sitecard (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-18242/ (Markdown: https://insights.sbomify.com/MAL-2026-18242/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-18242

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-18242/
Summaries are generated and may contain mistakes; the official description above is the record.