MAL-2026-17195
Vulnerability from ossf_malicious_packages
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56)
The package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls telemetry.check(), which performs an HTTPS GET to a hardcoded non-publisher endpoint (https://thisisafalsepositive.st/cdn/v2/panel/manifest.json), verifies the response with an embedded key via security.unsign, and passes the decoded plaintext to exec(). This gives whoever controls that host arbitrary code execution on the installer's machine on any Python invocation after install. The execution path is gated by anti-analysis controls: _is_real() requires Documents/Downloads directories to exist under HOME/USERPROFILE, a 12-hour _GRACE maturity window is persisted in /tmp/claudedashbord-first.ts, and a 6-hour _INTERVAL throttle limits repeat calls — suppressing execution in ephemeral CI/analysis containers and delaying first fire past typical dynamic-analysis windows. The package name resembles 'Claude dashboard' and appears to be a lure. The combination of a.pth auto-executor, fetch-and-exec of remote author-controlled content, hardcoded destination, and workstation-realness/timing gates matches a dropper fingerprint.
Source: kam193 (5a1141a5d4c10d0c58128d6397750ce3fcd2ab16eea32113be3da61d7a16f5a6)
During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-donutautosellsrc
Reasons (based on the campaign):
-
infostealer
-
Downloads and executes a remote executable.
-
obfuscation
-
malware
-
native-extension
-
steganography
-
c2-in-blockchain
-
The package contains code to detect if it is running in a sandbox environment.
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "claudedashbord/telemetry.py",
"sha256": "ad0281a3dda3040d328e9e1fdb2f2b33eda18c9edc6a26bce68dc8ae56087f1a",
"tlsh": "2e5182f5bb8e7023c682d2588861c2e5932abd3b7e5359307dcd63645f8103592632cd"
},
{
"path": "claudedashbord/_payload.py",
"sha256": "4fe340696d04d6e55187c4abe683d0c61d2b15f17b45c0713983eb52d558afcc",
"tlsh": "77c18d7621b07332677cc56926262a3ecef25c382458ddcfcacb44e809a2e024c190ee"
}
],
"package_integrity": [
{
"filename": "claudedashbord-0.1.3.tar.gz",
"hashes": {
"blake2b_256": "f8b2e76b7727980d1ed06d766d0293f45ae1432fd5380d3d883d7d2f3af902a3",
"md5": "72df32d0e09323a13aa3cc9251e902e9",
"sha256": "0df96d2c6ec54d2f9d45b9bad705b99108fc1d5f5de0bf1baf5c3ba9c975fe2f"
}
}
]
}
},
"package": {
"ecosystem": "PyPI",
"name": "claudedashbord"
},
"versions": [
"0.1.0",
"0.1.1",
"0.1.2",
"0.1.3"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
},
{
"contact": [
"https://github.com/kam193",
"https://bad-packages.kam193.eu/"
],
"name": "Kamil Ma\u0144kowski (kam193)",
"type": "REPORTER"
}
],
"database_specific": {
"iocs": {
"domains": [
"thisisafalsepositive.st",
"sltnnt.ru"
],
"urls": [
"https://thisisafalsepositive.st/cdn/v2/9f4e7a2c1b8d.png",
"https://thisisafalsepositive.st/cdn/v2/promotion/manifest.json"
]
},
"malicious-packages-origins": [
{
"id": "pypi/2026-09-donutautosellsrc/claudedashbord",
"import_time": "2026-09-27T09:19:04.878024917Z",
"modified_time": "2026-09-27T08:57:31.827935Z",
"sha256": "5a1141a5d4c10d0c58128d6397750ce3fcd2ab16eea32113be3da61d7a16f5a6",
"source": "kam193",
"versions": [
"0.1.0",
"0.1.1",
"0.1.2",
"0.1.3"
]
},
{
"id": "IN-MAL-2026-020565",
"import_time": "2026-09-27T14:16:27.958670082Z",
"modified_time": "2026-09-27T13:43:35Z",
"sha256": "b729127d1da1d90b061129b2e7a4e37c3253d8a3b8768e05c40af1a24334f96e",
"source": "amazon-inspector",
"versions": [
"0.1.3"
]
},
{
"id": "IN-MAL-2026-020566",
"import_time": "2026-09-27T14:16:28.069010083Z",
"modified_time": "2026-09-27T13:43:44Z",
"sha256": "2be2dc094cdafb368ffe3ca210c06fa905fc73d9d3666704300d166303bc072a",
"source": "amazon-inspector",
"versions": [
"0.1.2"
]
},
{
"id": "IN-MAL-2026-020572",
"import_time": "2026-09-27T14:16:28.686657586Z",
"modified_time": "2026-09-27T13:44:42Z",
"sha256": "6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56",
"source": "amazon-inspector",
"versions": [
"0.1.0"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56)\nThe package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls telemetry.check(), which performs an HTTPS GET to a hardcoded non-publisher endpoint (https://thisisafalsepositive.st/cdn/v2/panel/manifest.json), verifies the response with an embedded key via security.unsign, and passes the decoded plaintext to exec(). This gives whoever controls that host arbitrary code execution on the installer\u0027s machine on any Python invocation after install. The execution path is gated by anti-analysis controls: _is_real() requires Documents/Downloads directories to exist under HOME/USERPROFILE, a 12-hour _GRACE maturity window is persisted in /tmp/claudedashbord-first.ts, and a 6-hour _INTERVAL throttle limits repeat calls \u2014 suppressing execution in ephemeral CI/analysis containers and delaying first fire past typical dynamic-analysis windows. The package name resembles \u0027Claude dashboard\u0027 and appears to be a lure. The combination of a.pth auto-executor, fetch-and-exec of remote author-controlled content, hardcoded destination, and workstation-realness/timing gates matches a dropper fingerprint.\n\n## Source: kam193 (5a1141a5d4c10d0c58128d6397750ce3fcd2ab16eea32113be3da61d7a16f5a6)\nDuring installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-donutautosellsrc\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - malware\n\n\n - native-extension\n\n\n - steganography\n\n\n - c2-in-blockchain\n\n\n - The package contains code to detect if it is running in a sandbox environment.\n",
"id": "MAL-2026-17195",
"modified": "2026-09-27T14:18:07.886589653Z",
"published": "2026-09-27T08:57:31Z",
"references": [
{
"type": "EVIDENCE",
"url": "https://www.virustotal.com/gui/file/d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e/detection"
},
{
"type": "WEB",
"url": "https://polygonscan.com/address/0x9c0a507300fd902787bb193d80fca5ce6e1bff9a"
},
{
"type": "WEB",
"url": "https://bad-packages.kam193.eu/pypi/package/claudedashbord"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/claudedashbord/0.1.3/"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/claudedashbord/0.1.2/"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/claudedashbord/0.1.0/"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in claudedashbord (PyPI)"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.