# MAL-2026-4221: Malicious code in selfservsweeper (PyPI)


- **Type:** Malicious package
- **Package:** `selfservsweeper` (PyPI)
- **Published:** 21 May 2026

## What is MAL-2026-4221?

MAL-2026-4221 is a malicious package in selfservsweeper, published on 21 May 2026. 

### Official description

Package self-describes as a 'Touch-friendly Minesweeper overlay for NCR SelfServ kiosks', but the advertised CLI entrypoints (`selfservsweeper`, `selfservsweeper-cli`) call `run_app()` which auto-spawns `python -m selfservsweeper.selfservclient` as a side process. That module long-polls `https://api.telegram.org/bot<redacted>/` using a hardcoded bot token shipped in `src/selfservsweeper/api_url.pkl`, accepts commands prefixed `B2B1:` from the Telegram channel `@selfservserverbot`, and executes attacker-supplied 'jobs'. The job handler in `selfservclient.py` includes a `/file <path>` directive that writes attacker-supplied content to disk, and `send_file_result` reads any `path` field from a job result and uploads the raw bytes back to Telegram via `sendDocument` — a bidirectional read/write file primitive on the installer's machine. The Telegram bot token is identical for every install, so anyone who unpacks the wheel inherits command authority over every running instance. `grammarly.py` additionally loads bundled `.pkl` artifacts (`levenshtein.pkl`, `user_config_tempdir.pkl`) via `pickle.load` and binds the resulting callables as `edit_distance_cls` and `Sandbox._is_valid_path`, invoking them on attacker-controlled job text — an obfuscation channel for arbitrary code reduction. The `install --enable-startup` subcommand (and the GUI 'Enable' button) writes `%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\SelfServSweeper.vbs`, persisting the supervisor (and thus the Telegram client) across logins, and the supervisor's auto-update path `pip install`s the package on every boot to keep the backdoor live and self-updating. The minesweeper UI is cover; the package's effect on any installer who runs the advertised binary is a persistent, attacker-controlled remote command channel with file read/write reach.

When used, the package executes remote commands disguised as OCR job requests.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-selfservsweeper

Reasons (based on the campaign):

 - obfuscation

 - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

 - persistence

 - backdoor

## What should I do about MAL-2026-4221?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-4221 is a malicious package: selfservsweeper (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-4221/ (Markdown: https://insights.sbomify.com/MAL-2026-4221/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-4221

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-4221/
Summaries are generated and may contain mistakes; the official description above is the record.