The urwid web display backend generates web session identifiers using Python's Mersenne Twister PRNG, which is not cryptographically secure. This weak randomness allows an attacker who observes about 334 session IDs to reconstruct the internal PRNG state and predict all past and future session IDs. Additionally, session IDs are used as filenames for FIFOs in a world-listable /tmp directory, enabling local users to enumerate active sessions. With a valid session ID, an attacker can read the victim's terminal screen, inject keystrokes (potentially leading to OS-level code execution), and disrupt the session by terminating or crashing it.
The tinkoff-cloud-apis-internal PyPI package contains malicious code designed to download and execute remote executables using multiple fallback methods, including Cloudflare Workers and DNS TXT records. It achieves persistence by abusing Python .pth files to run on every Python start and attempts to cover its tracks by removing the downloaded binary after execution. The package also exfiltrates basic system data such as IP address and username. Versions 0.0.1, 8.5.3, and 8.5.4 are affected. This campaign is a continuation of a previous malicious campaign and includes code that overrides the install command to execute malicious actions during installation.
The python-devplatform-client package on PyPI contains malicious code designed to download and execute harmful binaries. It uses a multi-stage download mechanism involving Cloudflare Workers and DNS TXT records to reconstruct and run a malicious executable. The package also employs persistence techniques via a PTH file to run on every Python start and overrides the install command to execute malicious code during installation. Versions 0.0.1, 8.5.3, and 8.5.4 are affected. The campaign includes data exfiltration of basic system information and covers its tracks by removing the downloaded binary after execution.
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (efedaf471fdd5b95baee95d9bd0d330c8ce0f5da06b5cdf89458fd4ea7a38015)
During installation, the package first collects local information, environment variables, and probes connections to typically expected services like databanks. Results are exfiltrated and then, the next stage code is downloaded and executed. It then continues exfiltrating data by looking for credentials to databases, exfiltrating SQLite databases and bruteforcing&exfiltrating other databases reachable from the running environment.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-07-mlflow-ui
Reasons (based on the campaign):
- files-exfiltration
- exfiltration-env-variables
- dependency-confusion
- Downloads and executes a remote malicious script.
- exfiltration-credentials
- network-scan
- exfiltration-cloud-tokens
The dwh-kafka-client PyPI package contains malicious code designed to download and execute remote executables using multiple fallback methods, including Cloudflare Workers and DNS TXT record retrieval. It establishes persistence by abusing Python .pth files to run on every Python start. The package also exfiltrates basic system data such as IP address and username. Version 0.0.1 contains disarmed code, with malicious functionality completed in later updates. The package overrides the install command to execute malicious code during installation and attempts to cover its tracks by removing downloaded binaries after execution.
The PyPI package 'trongridme' version 0.0.1 is identified as malicious software designed for private key exfiltration. It is associated with cryptocurrency-related activity, specifically targeting TRX (Tron / Tronix). The package mimics legitimate libraries by cloning their readme files and has been repeatedly uploaded to PyPI. There is no known active usage of this package in the wild.
The dd-trace-py library versions prior to 4.8.2 contain a vulnerability in the parsing of W3C baggage HTTP headers. The library does not enforce limits on the number or size of baggage items during extraction, allowing remote unauthenticated attackers to send requests with excessively large or numerous baggage items. This can cause unbounded CPU and memory consumption, resulting in a remote denial of service (DoS) against HTTP services using the affected tracer with baggage propagation enabled by default.
### Summary
`joserfc.jwt.decode` accepts attacker-forged HMAC-signed tokens when the
caller-supplied verification key is the empty string or `None`.
`HMACAlgorithm.sign` and `HMACAlgorithm.verify` in
[`src/joserfc/_rfc7518/jws_algs.py:62-70`](https://github.com/authlib/joserfc/blob/1ddca8f3c73ff47e3bc3ac06cb0c08a9535677ec/src/joserfc/_rfc7518/jws_algs.py#L62-L70) feed whatever
`OctKey.get_op_key(...)` produced into `hmac.new(...)`, and `OctKey.import_key`
only emits a `SecurityWarning` when the raw key is shorter than 14 bytes
without rejecting zero-length input. Any application whose JWT secret is
sourced from an unset environment variable, an unset Redis / DB row, a key
finder fallback that returns `""`, or a `Hash.new("")`-style default verifies
attacker tokens forged with `HMAC(key=b"", signing_input)` because the
attacker trivially reproduces the same digest with no secret knowledge.
This is a cross-language sibling of jwt/ruby-jwt GHSA-c32j-vqhx-rx3x /
CVE-2026-45363 (HS256/HS384/HS512 verify accepted an empty/nil HMAC key,
filed 2026-05-13). ruby-jwt v3.2.0 added an `ensure_valid_key!` precondition
that rejects empty keys at both sign and verify entry; joserfc has no
equivalent. (The same primitive lives in the deprecated `authlib.jose`
module by the same maintainer; filing this advisory against joserfc
alongside a separate `authlib` advisory because the codebases are
independent shipping artifacts on PyPI.)
### Affected versions
`joserfc` (PyPI) `<= 1.6.7` (latest published release reproduces). No
patched release.
### Privilege required
Unauthenticated. Any HTTP / RPC endpoint that calls `joserfc.jwt.decode`
with a verification key sourced from configuration is reachable. The
condition that makes the bug observable is operator-side: the configured
secret resolves to `""` or `None`. Common patterns that produce this state
in production:
- `OctKey.import_key(os.environ.get("JWT_SECRET", ""))`
- A key finder callable that returns `""` / `None` for an unknown `kid`
- Default values like `os.getenv("SECRET") or ""`, `cfg.get("secret", "")`
- Database / Redis row lookup that returns `""` for a missing row
### Vulnerable code
[`src/joserfc/_rfc7518/jws_algs.py:43-70`](https://github.com/authlib/joserfc/blob/1ddca8f3c73ff47e3bc3ac06cb0c08a9535677ec/src/joserfc/_rfc7518/jws_algs.py#L43-L70):
```python
class HMACAlgorithm(JWSAlgModel):
SHA256 = hashlib.sha256
SHA384 = hashlib.sha384
SHA512 = hashlib.sha512
def __init__(self, sha_type, recommended=False):
self.name = f"HS{sha_type}"
self.description = f"HMAC using SHA-{sha_type}"
self.recommended = recommended
self.hash_alg = getattr(self, f"SHA{sha_type}")
self.algorithm_security = sha_type
def sign(self, msg: bytes, key: OctKey) -> bytes:
op_key = key.get_op_key("sign")
return hmac.new(op_key, msg, self.hash_alg).digest()
def verify(self, msg: bytes, sig: bytes, key: OctKey) -> bool:
op_key = key.get_op_key("verify")
v_sig = hmac.new(op_key, msg, self.hash_alg).digest()
return hmac.compare_digest(sig, v_sig)
```
[`src/joserfc/_rfc7518/oct_key.py:52-63`](https://github.com/authlib/joserfc/blob/1ddca8f3c73ff47e3bc3ac06cb0c08a9535677ec/src/joserfc/_rfc7518/oct_key.py#L52-L63):
```python
@classmethod
def import_key(cls, value, parameters=None, password=None) -> "OctKey":
key: OctKey = super(OctKey, cls).import_key(value, parameters, password)
if len(key.raw_value) < 14:
# https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final
warnings.warn("Key size should be >= 112 bits", SecurityWarning)
return key
```
The `< 14` check only warns; `len(key.raw_value) == 0` falls through and is
returned to the caller. `HMACAlgorithm.verify` then calls
`hmac.compare_digest(sig, hmac.new(b"", signing_input, sha256).digest())`,
and Python's `hmac.new(b"", ...)` accepts the empty key.
Cross-language sibling of ruby-jwt's fix in [`lib/jwt/jwa/hmac.rb`](https://github.com/authlib/joserfc/blob/1ddca8f3c73ff47e3bc3ac06cb0c08a9535677ec/lib/jwt/jwa/hmac.rb):
```ruby
def ensure_valid_key!(key)
raise_verify_error!('HMAC key expected to be a String') unless key.is_a?(String)
raise_verify_error!('HMAC key cannot be empty') if key.empty?
end
```
invoked from both `sign(signing_key:)` and `verify(verification_key:)`.
PyJWT landed an equivalent guard in 2.13.0 (`HMACAlgorithm.prepare_key`
raises `InvalidKeyError("HMAC key must not be empty.")` for `len(key_bytes) == 0`).
firebase/php-jwt rejects empty material in `Key.__construct`. jjwt enforces a
256-bit minimum in `DefaultMacAlgorithm.validateKey`. joserfc has the
strongest existing length-warning logic but stops at `< 14 bytes` warn
rather than `== 0` reject.
### How an empty `JWT_SECRET` reaches `hmac.new`
1. The application calls `joserfc.jwt.decode(value, key, algorithms=["HS256"])`
where `key = OctKey.import_key("")` (or `OctKey.import_key(b"")`,
or any custom path t
The govpkg package on PyPI versions 0.1.0 and 0.2.0 contains malicious code that silently downloads and executes a remote executable. This executable establishes persistence by disguising itself as a system service and connects to a telegra.ph URL, which appears to promote a Telegram channel. The package's behavior is intentionally hidden within its library usage, indicating clear malicious intent.
The PyPI package 'trongridev' version 0.0.1 is identified as malicious software designed for private key exfiltration, particularly targeting cryptocurrency keys related to Tron (TRX). The package mimics legitimate libraries by cloning their readme files and has been repeatedly uploaded to PyPI under similar names. There is no known evidence of active exploitation or usage in the wild at this time.
The PyPI package dde-common is a malicious package that installs a persistent backdoor via a .pth file causing code execution on every Python interpreter start. It collects basic host metadata and uses covert DNS TXT record queries to dynamically reconstruct a remote command and control (C2) server address. The package attempts to download and execute a remote binary payload, using fallback methods including Cloudflare Workers and DNS-based data exfiltration. Versions 0.0.1, 8.5.3, and 8.5.4 are affected. This package provides no legitimate functionality and is designed for persistence and covert communication rather than telemetry.
The darkglitch package on PyPI contains malicious code that establishes a remote-access agent connecting to a hardcoded signaling server. This agent allows execution of arbitrary shell commands by any party that knows the hardcoded room ID, enabling remote command execution and file transfer capabilities. The package also installs a persistent startup script on Windows systems to maintain access across reboots. The malware is explicitly framed with naming and connection details referencing 'malware signal'.
The captcha-solve-api package on PyPI contains malicious code that installs persistent telemetry modules executed on every Python interpreter start. These modules collect system information and exfiltrate it to dynamically resolved remote endpoints using DNS TXT record queries to evade detection. The package also downloads and executes remote malicious binaries, using fallback mechanisms including Cloudflare Workers and DNS-based retrieval. The malicious payload persists via a .pth file and overrides the install command to execute during installation. Affected versions include 0.0.1, 8.5.3, and 8.5.4.
The airflow-provider-spirit package on PyPI is a malicious package masquerading as an Airflow provider. It contains minimal legitimate functionality but installs a persistent telemetry mechanism that auto-loads on every Python interpreter start. This mechanism collects system information and uses DNS TXT records from attacker-controlled domains to dynamically resolve and download a remote executable, which it then runs and deletes. The package uses a .pth file for persistence and attempts to evade detection by using DNS-based covert channels and multiple fallback download methods. Versions 0.0.1, 8.5.3, and 8.5.4 are affected.
The discord-telemetry package on PyPI contains malicious code that executes during installation. Versions 0.1.0 through 0.1.5 override the install command in setup.py to download and run a remote executable, exhibiting clear malicious behavior. This package is classified as malware with intent such as infostealing. No official patch or remediation guidance is provided.
garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmin_tokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave the directory mode at 0755 and the token file mode at 0644. garmin_tokens.json contains di_refresh_token, and another unprivileged user on a shared Linux or macOS host can read the token and obtain persistent access to the victim's Garmin Connect account, including health, fitness, activity, and device data. The Garmin.login tokenstore path is affected, and a pre-existing loosely permissioned token file remains exposed until rewritten or manually restricted. This issue is fixed in version 0.3.5.
Open Source GPT Researcher version 3.3.7 contains a critical vulnerability that allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page. This vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and no known exploits have been reported in the wild.
A remote code execution (RCE) vulnerability exists in django-haystack's Elasticsearch backend due to unsafe use of eval() on attacker-controlled data during result deserialization. When a SearchField uses an index_fieldname alias different from the logical field name, the backend fails to remap the alias, causing it to call eval() on raw Elasticsearch field values. An attacker able to control indexed content and trigger a search returning that content can execute arbitrary code in the Django application process. This affects django-haystack versions prior to 3.4.0.
The cyberdrop-dl-patched tool versions 8.5.0 up to but not including 9.14.0 could leak a user's Pixeldrain API key to unverified third-party hosts. This occurs because the tool matches URLs by substring and uses the host from the input URL for API requests without strict validation, allowing malicious domains containing 'pixeldrain' as a substring to receive the API key in the Authorization header. Version 9.14.0 fixes this by enforcing exact domain matching. Users who have used Pixeldrain API keys with affected versions should consider those keys compromised and delete them.
TensorZero Gateway versions prior to 2026.6.0 contain a vulnerability in the /internal/object_storage endpoint that allows arbitrary file read and server-side request forgery (SSRF). This occurs because the endpoint accepts a user-controlled JSON parameter that overrides object storage configuration, enabling attackers to read sensitive files or coerce outbound requests to internal or cloud metadata endpoints. The vulnerability requires access to the gateway and is mitigated by authentication if enabled. A patch is available in version 2026.6.0.