Vulnerability-Lookup

mal-2026-923

Vulnerability from ossf_malicious_packages

Published

2026-01-05 23:50

Modified

2026-02-17 00:36

Summary

Malicious code in auto-backup-linux (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (e6f1fce241db64e9804a2eee083721b8374a2f27d8f4f2c51ce77a8e7687c61e)

Package performs a "backup" of files to a remote location. This functionality is clearly described, but the user has no control over the remote location where the collected files are sent, as well as no access to the "backed up" data. They are uploaded to a hardcoded Gofile account and as the downloading links are not saved anywhere, only the package author has access to them. In newer versions, packages explicitly target files with passwords, mnemonics, keys and crypto tokens. Also the command history and content of the clipboard are exfiltrated.

Furthermore, packages are closely related to and used in multiple Github repositories about cryptocurrencies, and other attractive toolsets, like free AI. When a user sets up one of these repositories, the auto-backup* packages are automatically installed. They are set - through a covered steps - to run as a scheduled task or periodic service, and exfiltrate sensitive data.

As an example, https://github.com/oxmoei/BatchCall-dapp :

Installation: https://github.com/oxmoei/BatchCall-dapp/blob/20dc21c96226481b3351ee477ad64e615a34b0c5/install.sh#L108
next, a remote script is executed: https://github.com/oxmoei/BatchCall-dapp/blob/20dc21c96226481b3351ee477ad64e615a34b0c5/install.sh#L124C10-L124C103
which then extracts base64-encoded scripts in the repository itself https://github.com/oxmoei/BatchCall-dapp/blob/20dc21c96226481b3351ee477ad64e615a34b0c5/.configs/config.ini#L22 and configures scheduled tasks/services/cronjobs/bashrc entries.

Scripts encoded in the repository call the "autobackup" command provided by auto-backup* Python packages. Effectively, the user's computer is infected with an infostealer.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-01-auto-backup

Reasons (based on the campaign):

files-exfiltration
infostealer
exfiltration-credentials
crypto-related
persistence

Credits

Kamil Mańkowski (kam193) github.com/kam193 bad-packages.kam193.eu/

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "auto-backup-linux"
      },
      "versions": [
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.0.4",
        "1.0.5",
        "1.0.6",
        "1.0.7"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)",
      "type": "ANALYST"
    },
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)",
      "type": "REPORTER"
    }
  ],
  "database_specific": {
    "iocs": {
      "urls": [
        "https://gist.githubusercontent.com/wongstarx/b1316f6ef4f6b0364c1a50b94bd61207/raw/install.sh",
        "https://github.com/oxmoei/BatchCall-dapp/",
        "https://github.com/oxmoei/polyseer/",
        "https://github.com/oxmoei/cursor-free-vip/",
        "https://github.com/oxmoei/Polymarket-trading-bot-15min-BTC/",
        "https://github.com/youssefmgerges/polyseer/",
        "https://github.com/youssefmgerges/Polymarket-trading-bot-15min-BTC",
        "https://github.com/youssefmgerges/cursor-free-vip/"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "pypi/2026-01-auto-backup/auto-backup-linux",
        "import_time": "2026-02-16T23:11:10.662317155Z",
        "modified_time": "2026-02-04T16:09:09.905286Z",
        "sha256": "716a7be40c73d0ffd69ea3fa8a513926c22f82303c1ae4dd86d80b89bf0a1098",
        "source": "kam193",
        "versions": [
          "1.0.1",
          "1.0.2",
          "1.0.3",
          "1.0.4",
          "1.0.5",
          "1.0.6",
          "1.0.7"
        ]
      },
      {
        "id": "pypi/2026-01-auto-backup/auto-backup-linux",
        "import_time": "2026-02-16T23:43:37.861381296Z",
        "modified_time": "2026-02-04T16:09:09.905286Z",
        "sha256": "53f041cd5e0f297b28bd4fefd76b2b307d532bbebcaf1e9772d275d3f697c049",
        "source": "kam193",
        "versions": [
          "1.0.1",
          "1.0.2",
          "1.0.3",
          "1.0.4",
          "1.0.5",
          "1.0.6",
          "1.0.7"
        ]
      },
      {
        "id": "pypi/2026-01-auto-backup/auto-backup-linux",
        "import_time": "2026-02-17T00:35:10.190957833Z",
        "modified_time": "2026-02-04T16:09:09.905286Z",
        "sha256": "e6f1fce241db64e9804a2eee083721b8374a2f27d8f4f2c51ce77a8e7687c61e",
        "source": "kam193",
        "versions": [
          "1.0.1",
          "1.0.2",
          "1.0.3",
          "1.0.4",
          "1.0.5",
          "1.0.6",
          "1.0.7"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (e6f1fce241db64e9804a2eee083721b8374a2f27d8f4f2c51ce77a8e7687c61e)\nPackage performs a \"backup\" of files to a remote location. This functionality is clearly described, but the user has no control over the remote location where the collected files are sent, as well as no access to the \"backed up\" data. They are uploaded to a hardcoded Gofile account and as the downloading links are not saved anywhere, only the package author has access to them. In newer versions, packages explicitly target files with passwords, mnemonics, keys and crypto tokens. Also the command history and content of the clipboard are exfiltrated.\n\nFurthermore, packages are closely related to and used in multiple Github repositories about cryptocurrencies, and other attractive toolsets, like free AI. When a user sets up one of these repositories, the auto-backup* packages are automatically installed. They are set - through a covered steps - to run as a scheduled task or periodic service, and exfiltrate sensitive data.\n\nAs an example, https://github.com/oxmoei/BatchCall-dapp :\n\n1. Installation: https://github.com/oxmoei/BatchCall-dapp/blob/20dc21c96226481b3351ee477ad64e615a34b0c5/install.sh#L108\n2. next, a remote script is executed: https://github.com/oxmoei/BatchCall-dapp/blob/20dc21c96226481b3351ee477ad64e615a34b0c5/install.sh#L124C10-L124C103\n3. which then extracts base64-encoded scripts in the repository itself https://github.com/oxmoei/BatchCall-dapp/blob/20dc21c96226481b3351ee477ad64e615a34b0c5/.configs/config.ini#L22 and configures scheduled tasks/services/cronjobs/bashrc entries.\n\nScripts encoded in the repository call the \"autobackup\" command provided by auto-backup* Python packages. Effectively, the user\u0027s computer is infected with an infostealer.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-01-auto-backup\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - infostealer\n\n\n - exfiltration-credentials\n\n\n - crypto-related\n\n\n - persistence\n",
  "id": "MAL-2026-923",
  "modified": "2026-02-17T00:36:40Z",
  "published": "2026-01-05T23:50:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oxmoei/BatchCall-dapp/blob/20dc21c96226481b3351ee477ad64e615a34b0c5/install.sh#L116"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oxmoei/BatchCall-dapp/blob/20dc21c96226481b3351ee477ad64e615a34b0c5/.configs/config.ini#L22"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oxmoei/polyseer/blob/ee72cef85257d3293be791cb091bf3d1767cac1d/install.sh#L135"
    },
    {
      "type": "WEB",
      "url": "https://github.com/youssefmgerges/polyseer/blob/b4dad9a57954a77b2e7eaff17f71fd51efdb179b/install.sh#L147"
    },
    {
      "type": "WEB",
      "url": "https://github.com/youssefmgerges/Polymarket-trading-bot-15min-BTC/blob/829c2f0665be408411a152aa646b17f5cd857daf/install.sh#L179"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oxmoei/cursor-free-vip/blob/1c2226ea4f6271a1f0cf05c86c1a8d3966fb6e1a/install.sh#L176"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oxmoei/Polymarket-trading-bot-15min-BTC/blob/6faaf0959a2ddbd6b307f722cd4b25d8a128cd37/install.sh#L179"
    },
    {
      "type": "WEB",
      "url": "https://github.com/youssefmgerges/cursor-free-vip/blob/e32795819da22a35ccc20b9e5a63d0f056ea8f04/install.sh#L176"
    },
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/auto-backup-linux"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in auto-backup-linux (PyPI)"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

mal-2026-923

Vulnerability from ossf_malicious_packages

Source: kam193 (e6f1fce241db64e9804a2eee083721b8374a2f27d8f4f2c51ce77a8e7687c61e)

Tags

Sightings

Nomenclature