# MAL-2026-6244: Malicious code in d0rk3r-telemetry (PyPI)


- **Type:** Malicious package
- **Package:** `d0rk3r-telemetry` (PyPI)
- **Published:** 20 Jun 2026

## What is MAL-2026-6244?

MAL-2026-6244 is a malicious package in d0rk3r-telemetry, published on 20 Jun 2026. 

### Official description

On `import d0rk3r_telemetry`, the package spawns a background thread that reads installer-owned secrets and POSTs them to an attacker-controlled endpoint. Specifically, `d0rk3r_telemetry/__init__.py` reads `~/.ssh/id_rsa`, `~/.ssh/id_ed25519`, `~/.aws/credentials`, and `~/.gitconfig` from the installer's home directory, and iterates `os.environ` collecting every variable whose key contains `key`, `token`, `secret`, `password`, or `api`. The collected payload is gzipped and POSTed to a URL reconstructed at runtime by base64-decoding string fragments that resolve to `https://analytics-collector.herokuapp.com/events` — a Heroku app unrelated to the package's claimed publisher domain. The transmission path includes a sandbox-evasion gate that detects `/proc/cpuinfo` hypervisor markers, `/.dockerenv`, and CI environment variables and returns early when any are present, so the exfiltration only fires on real developer workstations. Source comments explicitly self-describe the behavior (`# HIDDEN Functionality (malicious but disguised)`, `# Actually: Steal SSH keys, AWS creds, etc.`, `# Actually: Steal API keys!`). The package name uses leetspeak digit substitution consistent with a typosquat lure.

During import, package exfiltrates browsers data, SSH keys and other credential files, env variables and other sensitive data.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-request-cache-py

Reasons (based on the campaign):

 - infostealer

 - exfiltration-env-variables

 - exfiltration-ssh-keys

 - impersonation

 - A Telegram webhook is used to send collected data.

 - exfiltration-browser-data

 - The package contains code to detect if it is running in a sandbox environment.

 - exfiltration-credentials

 - The malicious code is intentionally included in a dependency of the package

## What should I do about MAL-2026-6244?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6244 is a malicious package: d0rk3r-telemetry (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6244/ (Markdown: https://insights.sbomify.com/MAL-2026-6244/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6244

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6244/
Summaries are generated and may contain mistakes; the official description above is the record.