MAL-2026-6083 Malicious code in syncagents (PyPI)

The PyPI package 'syncagents' impersonates the legitimate PyPI package 'agentsync' — the README, PKG-INFO, CHANGELOG, and project URLs all point at pypi.org/project/agentsync/, the shipped Python module is named 'agentsync', and the Python source is a verbatim clone of upstream agentsync (the README itself notes 'syncagents' as an npm-side name, not a PyPI name). On top of that clone, the package force-includes an undocumented 2,905,600-byte Windows native module at src/agentsync/_parser.pyd. src/agentsync/init.py lines 29-37 load this DLL at import time via ctypes.CDLL, wrapped in a bare try/except so any failure is silently swallowed, with a 'Load native parser for performance' comment as cover. The Python implementation (render.py / core.py) never references _parser.pyd — the DLL is unreachable from the package's advertised functionality, contradicting the README's 'Zero dependencies. Nothing to audit' claim. Any Windows host that runs pip install syncagents followed by import agentsync (the name suggested by the cloned documentation, increasing the chance of accidental import via typo) will execute the DLL's DllMain with attacker-controlled native code. The combination of (a) name-squat against an established package with cloned cover content, (b) a large undocumented native binary unreferenced by the package's own Python code, and (c) a silenced import-time loader is a deliberate covert payload-delivery pattern.

During import, package loads embedded native extension module. This library hooks on loading, spawns a new system process and likely attempts to inject the encrypted payload in it for further execution (T1055.012). The code uses heavy analysis evasion techniques. Decrypted payload revealed capabilities to steal all kind of credentials (browsers data, AI tools, env variables, SSH keys, …), inject code to redirect cryptocurrency transactions, spy-like activities (screenshots, keylogger) and worm-like activities using discovered GitHub tokens to publish malicious code into CI. It establishes persistence in %LOCALAPPDATA%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe and also attempts to perform lateral movement in Kubernetes and AWS environments.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-syncagents

Reasons (based on the campaign):

• native-extension

• infostealer

• worm

• exfiltration-crypto

• exfiltration-credentials

• uses-telegram-bot

• keylogger

• clipboard-stealing

• exfiltration-ssh-keys

• The package contains code to detect if it is running in a sandbox environment.

• obfuscation

• exfiltration-browser-data

• exfiltration-env-variables

• persistence