{"answers":{"affected":"1 open source package ship an affected version, including d0rk3r-telemetry.","exploited":"There is no known exploitation of MAL-2026-6244 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6244 is a malicious package in d0rk3r-telemetry, published on 20 Jun 2026."},"fix_prompt":"MAL-2026-6244 is a malicious package: d0rk3r-telemetry (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6244/ (Markdown: https://insights.sbomify.com/MAL-2026-6244/index.md)","id":"MAL-2026-6244","markdown":"https://insights.sbomify.com/MAL-2026-6244/index.md","name":"MAL-2026-6244","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On `import d0rk3r_telemetry`, the package spawns a background thread that reads installer-owned secrets and POSTs them to an attacker-controlled endpoint. Specifically, `d0rk3r_telemetry/__init__.py` reads `~/.ssh/id_rsa`, `~/.ssh/id_ed25519`, `~/.aws/credentials`, and `~/.gitconfig` from the installer's home directory, and iterates `os.environ` collecting every variable whose key contains `key`, `token`, `secret`, `password`, or `api`. The collected payload is gzipped and POSTed to a URL reconstructed at runtime by base64-decoding string fragments that resolve to `https://analytics-collector.herokuapp.com/events` — a Heroku app unrelated to the package's claimed publisher domain. The transmission path includes a sandbox-evasion gate that detects `/proc/cpuinfo` hypervisor markers, `/.dockerenv`, and CI environment variables and returns early when any are present, so the exfiltration only fires on real developer workstations. Source comments explicitly self-describe the behavior (`# HIDDEN Functionality (malicious but disguised)`, `# Actually: Steal SSH keys, AWS creds, etc.`, `# Actually: Steal API keys!`). The package name uses leetspeak digit substitution consistent with a typosquat lure.\n\nDuring import, package exfiltrates browsers data, SSH keys and other credential files, env variables and other sensitive data.\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\nCampaign: 2026-06-request-cache-py\n\nReasons (based on the campaign):\n\n - infostealer\n\n - exfiltration-env-variables\n\n - exfiltration-ssh-keys\n\n - impersonation\n\n - A Telegram webhook is used to send collected data.\n\n - exfiltration-browser-data\n\n - The package contains code to detect if it is running in a sandbox environment.\n\n - exfiltration-credentials\n\n - The malicious code is intentionally included in a dependency of the package","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in d0rk3r-telemetry (PyPI)","id":"MAL-2026-6244","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"d0rk3r-telemetry","purl":"pkg:pypi/d0rk3r-telemetry","source":"MAL-2026-6244"}],"products":null,"published":"2026-06-20","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6244/"}