# MAL-2026-5329: Malicious code in spaysdatarbx (PyPI)


- **Type:** Malicious package
- **Package:** `spaysdatarbx` (PyPI)
- **Published:** 8 Jun 2026

## What is MAL-2026-5329?

MAL-2026-5329 is a malicious package in spaysdatarbx, published on 8 Jun 2026. 

### Official description

spaysdatarbx is a Windows infostealer disguised as a Roblox DataStore library. On `import spaysdata`, __init__.py invokes main_entry() (wrapped in try/except: pass to stay silent), which performs three malicious actions: (1) reads %USERPROFILE%/AppData/Local/Roblox/LocalStorage/robloxcookies.dat, DPAPI-decrypts it, and POSTs the plaintext Roblox session cookie to a hardcoded Discord webhook (https://discord.com/api/webhooks/1499336276762038292/...); (2) walks Discord, Chrome, Edge, Brave, Opera, Yandex, and Firefox profile directories, force-kills Discord with `taskkill /f /im Discord.exe` to release leveldb locks, AES-GCM-decrypts auth tokens with each browser's DPAPI master key, and POSTs every recovered token to the same webhook; (3) establishes persistence by copying itself to %APPDATA%\MySystemUtility\ and writing an HKCU\...\Run\MyPythonAutostartApp registry value that re-launches the stealer at every login, hiding the console window via ShowWindow(GetConsoleWindow(), 0). The package's advertised purpose ('Библиотека для работы с DataStore в Roblox') is a decoy — no DataStore functionality exists in main.py, only the stealer. Any developer who installs and imports this package has their Roblox session and all browser-stored Discord tokens sent to the attacker, plus a persistent autostart entry for ongoing theft.

The package exfiltrates Roblox cookies from the victim machine.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-spaysrbdata

Reasons (based on the campaign):

 - infostealer

## What should I do about MAL-2026-5329?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-5329 is a malicious package: spaysdatarbx (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-5329/ (Markdown: https://insights.sbomify.com/MAL-2026-5329/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-5329

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-5329/
Summaries are generated and may contain mistakes; the official description above is the record.