MAL-2026-17919
Vulnerability from ossf_malicious_packages – Published: 2026-10-17 16:53 – Updated: 2026-10-19 00:41 – Source website| Ecosystem | Package | Versions |
|---|---|---|
| PyPI |
ukraine69
|
1.2.01.2.11.2.21.2.31.2.51.2.61.2.71.2.8
|
Importing ukraine69 in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local .vault files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts account.deleteAccount using GoyGram, with a Telethon fallback in versions 1.2.5–1.2.8. The payloads also attempt to remove local vault/session files and ukraine69 installation and cache traces; the condition for vault removal differs among revisions. Versions 1.2.5–1.2.8 specifically target Hotaru session vault layouts, and 1.2.7–1.2.8 additionally try auth.checkPassword if a password is present in the vault. Version 1.2.8 also attempts persistence on import: it backs up and patches a discovered Hotaru checkout's hotaru/__main__.py so a self-contained hook attempts account deletion again when Hotaru restarts, then removes the local vault/session on reported success. Version 1.2.3 instead launches import-triggered reconnaissance: a detached child reads up to three vaults in the user's home or working directory and writes their first 200 bytes plus environment and filesystem observations to local .u69_recon.log files. No external exfiltration or account-deletion call appears in 1.2.3. All listed versions advertise Ukrainian locale helpers; installation alone does not execute the module. Actual account deletion, successful Hotaru patching, later use of the local logs, and victim execution have not been established by this static analysis.
The package's init.py presents a benign Ukrainian-locale API (transliterate, flag, month_name, format_date) but at import time generates and launches detached, isolated Python agents via sys.executable -I -c <generated code> with start_new_session=True, inheriting the installer's HOME, cwd, and network. The spawned agents glob the installer's filesystem (~/.hotaru/**, ~/.local/share/hotaru/**, ~/**/*.vault, /tmp/hotaru*, cwd ancestors, and HOTARU_ACCOUNT_ROOT/HOTARU_ACCOUNT_SESSION-hinted paths) for *.vault files, decrypt them via goygram.security._read_vault, and extract MTProto auth_key/api_id/api_hash/dc material belonging to the installer's Telegram accounts. Using the stolen credentials, the agents connect to hardcoded Telegram DC IPv4 addresses (149.154.175.53, 149.154.167.51, 149.154.175.100, 149.154.167.91, 91.108.56.130) and invoke account.deleteAccount via multiple MTProto client surfaces (goygram dict/attribute/callable styles, raw mt.send, with a Telethon fallback), destructively deleting the installer's Telegram accounts. A follow-up _gc_script sleeps 45 seconds and then recursively removes the package from ~/.cache/hotaru/module-deps/<id>/, ~/.cache/pip/wheels, ~/.cache/pip/http-v2, ~/.cache/uv, /tmp/probe-*, and the matching site-packages dist-info, plus deletes the targeted vault and sibling .session files after successful account deletion, serving as anti-forensics self-destruct. The package's own docstring self-identifies as a Hotaru sandbox-escape payload that executes at import time.
During import, package performs actions intended to escape sandbox, find Telegram-bot session files and initiate malicious account deletion.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-ukraine69
Reasons (based on the campaign):
-
destructive-actions
-
covering-tracks
No description from this source.
No description from this source.
No description from this source.
No description from this source.
No description from this source.
No description from this source.
| Type | Indicator | Hashes |
|---|---|---|
| Evidence file |
ukraine69/__init__.py
|
sha256
6b36b90468c442a02d0cc6aaf3b401a96d54d34d85f6aac49b2bcb074aea44e6tlsh
b5f18620a4125823e347ea5e4916d0e02b1eb977350a5d74b9fc7e44ffcd6b182b46bc |
| Package archive |
ukraine69-1.2.1-py3-none-any.whl
|
blake2b_256
94923895a2d5a934ea9f9c05d9f316d7bca905eb3fac863fdf3051aa14e4277bmd5
e57c3121790dc1bbf5ed5da734bd5660sha256
576037f8bd79689977cdb4528b188acfe53f773025dac244825a08620ce8dfa0 |
- CWE-506 - Embedded Malicious Code
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "ukraine69/__init__.py",
"sha256": "6b36b90468c442a02d0cc6aaf3b401a96d54d34d85f6aac49b2bcb074aea44e6",
"tlsh": "b5f18620a4125823e347ea5e4916d0e02b1eb977350a5d74b9fc7e44ffcd6b182b46bc"
}
],
"package_integrity": [
{
"filename": "ukraine69-1.2.1-py3-none-any.whl",
"hashes": {
"blake2b_256": "94923895a2d5a934ea9f9c05d9f316d7bca905eb3fac863fdf3051aa14e4277b",
"md5": "e57c3121790dc1bbf5ed5da734bd5660",
"sha256": "576037f8bd79689977cdb4528b188acfe53f773025dac244825a08620ce8dfa0"
}
}
]
}
},
"package": {
"ecosystem": "PyPI",
"name": "ukraine69"
},
"versions": [
"1.2.0",
"1.2.1",
"1.2.2",
"1.2.3",
"1.2.5",
"1.2.6",
"1.2.7",
"1.2.8"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
},
{
"contact": [
"https://www.estsecurity.com/"
],
"name": "ESTsecurity",
"type": "FINDER"
},
{
"contact": [
"https://github.com/kam193",
"https://bad-packages.kam193.eu/"
],
"name": "Kamil Ma\u0144kowski (kam193)",
"type": "REPORTER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"id": "pypi/2026-10-ukraine69/ukraine69",
"import_time": "2026-10-17T17:38:26.306032386Z",
"modified_time": "2026-10-17T16:53:55.661733Z",
"sha256": "751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a",
"source": "kam193",
"versions": [
"1.2.0",
"1.2.1",
"1.2.2",
"1.2.3",
"1.2.5",
"1.2.6",
"1.2.7",
"1.2.8"
]
},
{
"id": "IN-MAL-2026-021519",
"import_time": "2026-10-18T01:52:23.72296384Z",
"modified_time": "2026-10-18T01:49:53Z",
"sha256": "33f42716a2bf353999fae2be805c5c9ca6ad9811920ee2ccec733a0647120831",
"source": "amazon-inspector",
"versions": [
"1.2.1"
]
},
{
"id": "IN-MAL-2026-021515",
"import_time": "2026-10-18T01:52:23.398656642Z",
"modified_time": "2026-10-18T01:49:18Z",
"sha256": "4b8244951c9ae4f7baac94c3e7fd803e3c3ceaa27d64c2561cce098bd9dddf77",
"source": "amazon-inspector",
"versions": [
"1.2.6"
]
},
{
"id": "IN-MAL-2026-021522",
"import_time": "2026-10-18T01:52:23.961292396Z",
"modified_time": "2026-10-18T01:50:15Z",
"sha256": "802aefe7084d5b846d6d2dec2b00c6c59c3ffd95e5c8a674653cf8c16e0558aa",
"source": "amazon-inspector",
"versions": [
"1.2.0"
]
},
{
"id": "IN-MAL-2026-021521",
"import_time": "2026-10-18T01:52:23.881468368Z",
"modified_time": "2026-10-18T01:50:05Z",
"sha256": "8e933b1d75adc3025a2cb071396e7db13f81da48da6a23bf4a84b2955e80d032",
"source": "amazon-inspector",
"versions": [
"1.2.2"
]
},
{
"id": "IN-MAL-2026-021518",
"import_time": "2026-10-18T01:52:23.635032435Z",
"modified_time": "2026-10-18T01:49:43Z",
"sha256": "9d6ffd39c8600f034e5e15148b7bbbab5b3d4454d3b0cb3a04af071af017e9d9",
"source": "amazon-inspector",
"versions": [
"1.2.8"
]
},
{
"id": "IN-MAL-2026-021517",
"import_time": "2026-10-18T01:52:23.556233738Z",
"modified_time": "2026-10-18T01:49:35Z",
"sha256": "ad925525ff7c3ccbb1e6859728387aeaf83681aa88829eda1406e70338f64b7e",
"source": "amazon-inspector",
"versions": [
"1.2.7"
]
},
{
"id": "IN-MAL-2026-021516",
"import_time": "2026-10-18T01:52:23.478882569Z",
"modified_time": "2026-10-18T01:49:29Z",
"sha256": "dff8e4c0a3df260243f56e218dce6c7092138e26578f8395fdeca348041835ce",
"source": "amazon-inspector",
"versions": [
"1.2.5"
]
}
]
},
"details": "Importing `ukraine69` in versions 1.2.0\u20131.2.2 and 1.2.5\u20131.2.8 searches for local `.vault` files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts `account.deleteAccount` using GoyGram, with a Telethon fallback in versions 1.2.5\u20131.2.8. The payloads also attempt to remove local vault/session files and `ukraine69` installation and cache traces; the condition for vault removal differs among revisions. Versions 1.2.5\u20131.2.8 specifically target Hotaru session vault layouts, and 1.2.7\u20131.2.8 additionally try `auth.checkPassword` if a password is present in the vault. Version 1.2.8 also attempts persistence on import: it backs up and patches a discovered Hotaru checkout\u0027s `hotaru/__main__.py` so a self-contained hook attempts account deletion again when Hotaru restarts, then removes the local vault/session on reported success. Version 1.2.3 instead launches import-triggered reconnaissance: a detached child reads up to three vaults in the user\u0027s home or working directory and writes their first 200 bytes plus environment and filesystem observations to local `.u69_recon.log` files. No external exfiltration or account-deletion call appears in 1.2.3. All listed versions advertise Ukrainian locale helpers; installation alone does not execute the module. Actual account deletion, successful Hotaru patching, later use of the local logs, and victim execution have not been established by this static analysis.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4b8244951c9ae4f7baac94c3e7fd803e3c3ceaa27d64c2561cce098bd9dddf77)\nThe package\u0027s __init__.py presents a benign Ukrainian-locale API (transliterate, flag, month_name, format_date) but at import time generates and launches detached, isolated Python agents via `sys.executable -I -c \u003cgenerated code\u003e` with `start_new_session=True`, inheriting the installer\u0027s HOME, cwd, and network. The spawned agents glob the installer\u0027s filesystem (`~/.hotaru/**`, `~/.local/share/hotaru/**`, `~/**/*.vault`, `/tmp/hotaru*`, cwd ancestors, and `HOTARU_ACCOUNT_ROOT`/`HOTARU_ACCOUNT_SESSION`-hinted paths) for `*.vault` files, decrypt them via `goygram.security._read_vault`, and extract MTProto `auth_key`/`api_id`/`api_hash`/`dc` material belonging to the installer\u0027s Telegram accounts. Using the stolen credentials, the agents connect to hardcoded Telegram DC IPv4 addresses (149.154.175.53, 149.154.167.51, 149.154.175.100, 149.154.167.91, 91.108.56.130) and invoke `account.deleteAccount` via multiple MTProto client surfaces (goygram dict/attribute/callable styles, raw `mt.send`, with a Telethon fallback), destructively deleting the installer\u0027s Telegram accounts. A follow-up `_gc_script` sleeps 45 seconds and then recursively removes the package from `~/.cache/hotaru/module-deps/\u003cid\u003e/`, `~/.cache/pip/wheels`, `~/.cache/pip/http-v2`, `~/.cache/uv`, `/tmp/probe-*`, and the matching site-packages dist-info, plus deletes the targeted vault and sibling `.session` files after successful account deletion, serving as anti-forensics self-destruct. The package\u0027s own docstring self-identifies as a `Hotaru sandbox-escape payload` that `executes at import time`.\n\n## Source: kam193 (751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a)\nDuring import, package performs actions intended to escape sandbox, find Telegram-bot session files and initiate malicious account deletion.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-ukraine69\n\n\nReasons (based on the campaign):\n\n\n - destructive-actions\n\n\n - covering-tracks\n",
"id": "MAL-2026-17919",
"modified": "2026-10-19T00:41:45.197192069Z",
"published": "2026-10-17T16:53:55Z",
"references": [
{
"type": "WEB",
"url": "https://bad-packages.kam193.eu/pypi/package/ukraine69"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/ukraine69/1.2.1/"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/ukraine69/1.2.6/"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/ukraine69/1.2.0/"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/ukraine69/1.2.2/"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/ukraine69/1.2.8/"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/ukraine69/1.2.7/"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/ukraine69/1.2.5/"
},
{
"type": "EVIDENCE",
"url": "https://inspector.pypi.io/project/ukraine69/1.2.0/packages/2c/3f/e51de071990c6e81c9f9d59b7adde323fd0dacd0e52961513ccae945aeb6/ukraine69-1.2.0-py3-none-any.whl/ukraine69/__init__.py#line.208"
},
{
"type": "EVIDENCE",
"url": "https://inspector.pypi.io/project/ukraine69/1.2.1/packages/94/92/3895a2d5a934ea9f9c05d9f316d7bca905eb3fac863fdf3051aa14e4277b/ukraine69-1.2.1-py3-none-any.whl/ukraine69/__init__.py#line.208"
},
{
"type": "EVIDENCE",
"url": "https://inspector.pypi.io/project/ukraine69/1.2.2/packages/45/be/70b11f7a1065b918fff7e273a8929cfec6117ba10f6da1b9651d6fc6b0a9/ukraine69-1.2.2-py3-none-any.whl/ukraine69/__init__.py#line.221"
},
{
"type": "EVIDENCE",
"url": "https://inspector.pypi.io/project/ukraine69/1.2.3/packages/69/a0/b71eda561d5b482f528b562285e74dbdbc74a4879d1b328f3c5712f42621/ukraine69-1.2.3-py3-none-any.whl/ukraine69/__init__.py#line.120"
},
{
"type": "EVIDENCE",
"url": "https://inspector.pypi.io/project/ukraine69/1.2.5/packages/98/2a/40f168e0a9989e6c72650df04f7ec3cc0b4e11481b5d987c7c6990d294b2/ukraine69-1.2.5-py3-none-any.whl/ukraine69/__init__.py#line.321"
},
{
"type": "EVIDENCE",
"url": "https://inspector.pypi.io/project/ukraine69/1.2.6/packages/40/65/cf3c297418f42056da1aa1ac74dee1a2ada2bc9e7048701429acd6fb17f2/ukraine69-1.2.6-py3-none-any.whl/ukraine69/__init__.py#line.354"
},
{
"type": "EVIDENCE",
"url": "https://inspector.pypi.io/project/ukraine69/1.2.7/packages/1e/b8/421ab6c05f83983a337619596ad8e40126aa6319afdc91d73865da43ff8e/ukraine69-1.2.7-py3-none-any.whl/ukraine69/__init__.py#line.406"
},
{
"type": "EVIDENCE",
"url": "https://inspector.pypi.io/project/ukraine69/1.2.8/packages/64/23/da183671983a86a4c92daffd479996dc61e50c93ac6f73d62083294dec4d/ukraine69-1.2.8-py3-none-any.whl/ukraine69/__init__.py#line.861"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in ukraine69 (PyPI)"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.