{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "scrapetools2/downloader.py",
              "sha256": "f6de293017d338dfe34f90026e76012f6ae7eb2d18e7e6d9f963199e8cd1314c",
              "tlsh": "2db1a453d8a6aeba9367d47c086ad151b335a9073b1042743ffc62a80f4563947e47ec"
            },
            {
              "path": "scrapetools2/packer.py",
              "sha256": "b140d03415affdb26eb34dd8ba6bee4c4fac05bc106baf1e4fd31b27a68a6bd7",
              "tlsh": "932198a1bcd91a80d38bc0284422c910f2a9bc5f1301a1657e8cabe4af8817ff6a45cd"
            }
          ],
          "package_integrity": [
            {
              "filename": "scrapetools2-1.2.1-py2.py3-none-any.whl",
              "hashes": {
                "blake2b_256": "609a817a6d63406fd35c09ee2be49d50210313c81903a935410366e2e38fa214",
                "md5": "7cf44493b43d599944e6c3a803a5e736",
                "sha256": "e0f1f58f241c64e04e3f7946436403c695e30040dc7733b97cd69dcc30d77168"
              }
            },
            {
              "filename": "scrapetools2-1.2.1.tar.gz",
              "hashes": {
                "blake2b_256": "02730598c74da7b7e25a8fac62c6951ec15cf25b3091ae6ebab46778306591d8",
                "md5": "22bafa8e1af53276d230ab5a415bff6e",
                "sha256": "8d4d42e93e67612862888adb1bee1c1254a8ed21aa30570b438a47b291759eee"
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "scrapetools2"
      },
      "versions": [
        "1.2.1",
        "1.2.0",
        "0.2.0",
        "0.2.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020574",
        "import_time": "2026-09-27T14:39:14.047216022Z",
        "modified_time": "2026-09-27T14:33:48Z",
        "sha256": "44124d389269a5e4dc8801d3af1afeb08aee57313fcc7082570c5890e7d89233",
        "source": "amazon-inspector",
        "versions": [
          "1.2.1"
        ]
      },
      {
        "id": "IN-MAL-2026-020575",
        "import_time": "2026-09-27T14:39:14.122558966Z",
        "modified_time": "2026-09-27T14:33:58Z",
        "sha256": "8510a108179eb7e480d606cb4f037c1365007926af575afc80ec0d9f077f1b0a",
        "source": "amazon-inspector",
        "versions": [
          "1.2.0"
        ]
      },
      {
        "id": "IN-MAL-2026-020576",
        "import_time": "2026-09-27T14:39:14.180076006Z",
        "modified_time": "2026-09-27T14:34:10Z",
        "sha256": "cf460a24ad3c20f436eb20e2974b090ae761ebb02e170d92c34aadf23b320007",
        "source": "amazon-inspector",
        "versions": [
          "0.2.0"
        ]
      },
      {
        "id": "IN-MAL-2026-020577",
        "import_time": "2026-09-27T14:39:14.234216761Z",
        "modified_time": "2026-09-27T14:34:20Z",
        "sha256": "d1ccba931f3617a01ef93e1f81268e9cd3cc74645566804cb1ab64e53f6ded64",
        "source": "amazon-inspector",
        "versions": [
          "0.2.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (44124d389269a5e4dc8801d3af1afeb08aee57313fcc7082570c5890e7d89233)\nscrapetools2 1.2.1 ships an auto-update mechanism in downloader.py that fetches tar.gz payloads from public IPFS gateways (eu.orbitor.dev, dget.top, ipfs.filebase.io) at the author-controlled IPNS name k51qzi5uqu5dmh5178x8jzdkz8u3k3qona4zrwlvdr6865it3901l1oe8emjwc, decrypts an \u0027updates\u0027 entry using a Fernet key bundled inside the package (scrapetools2/versions), writes each decrypted blob to scrapetools2/modules/N.py, and then compile()+exec()s them in-process. The updater is invoked via runtime.DBConsumer.startQueue -\u003e updater() and loops on a 60-second interval, so any code path that reaches the advertised RuntimeSite/browser-pool flow triggers the fetch-and-execute cycle. The package additionally ships an encrypted \u0027updates\u0027 blob decrypted by packer.unpackdata into a JSON {\"cmd\":...} whose contents are written to modules/*.py and exec\u0027d by run_modules(); the executed source is not visible in the sdist without the bundled key. Because IPNS is a mutable pointer under the holder\u0027s control and the only integrity check is a Fernet key shipped with the package, whoever controls the IPNS name can push arbitrary Python that will be executed on installer hosts.\n",
  "id": "MAL-2026-17199",
  "modified": "2026-09-27T14:41:05Z",
  "published": "2026-09-27T14:33:48Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/scrapetools2/1.2.1/"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/scrapetools2/1.2.0/"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/scrapetools2/0.2.0/"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/scrapetools2/0.2.1/"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in scrapetools2 (PyPI)"
}