Malicious code in claudedashbord (PyPI)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56) The package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls telemetry.check(), which performs an HTTPS GET to a hardcoded non-publisher endpoint (https://thisisafalsepositive.st/cdn/v2/panel/manifest.json), verifies the response with an embedded key via security.unsign, and passes the decoded plaintext to exec(). This gives whoever controls that host arbitrary code execution on the installer's machine on any Python invocation after install. The execution path is gated by anti-analysis controls: _is_real() requires Documents/Downloads directories to exist under HOME/USERPROFILE, a 12-hour _GRACE maturity window is persisted in /tmp/claudedashbord-first.ts, and a 6-hour _INTERVAL throttle limits repeat calls — suppressing execution in ephemeral CI/analysis containers and delaying first fire past typical dynamic-analysis windows. The package name resembles 'Claude dashboard' and appears to be a lure. The combination of a.pth auto-executor, fetch-and-exec of remote author-controlled content, hardcoded destination, and workstation-realness/timing gates matches a dropper fingerprint. ## Source: kam193 (5a1141a5d4c10d0c58128d6397750ce3fcd2ab16eea32113be3da61d7a16f5a6) During installation, obfuscated code is used to fetch code hidden in an image
MAL-2026-17195
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17195
claudedashbord
Source reference: /affected/0/package/name
- Affected versions
- 0.1.0
Source reference:
/affected/0/versions0.1.1Source reference:
/affected/0/versions0.1.2Source reference:
/affected/0/versions0.1.3Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "claudedashbord",
"purl": "pkg:pypi/claudedashbord",
"ecosystem": "PyPI"
},
"versions": [
"0.1.0",
"0.1.1",
"0.1.2",
"0.1.3"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/claudedashbord/MAL-2026-17195.json",
"indicators": {
"evidence_files": [
{
"path": "claudedashbord/telemetry.py",
"tlsh": "2e5182f5bb8e7023c682d2588861c2e5932abd3b7e5359307dcd63645f8103592632cd",
"sha256": "ad0281a3dda3040d328e9e1fdb2f2b33eda18c9edc6a26bce68dc8ae56087f1a"
},
{
"path": "claudedashbord/_payload.py",
"tlsh": "77c18d7621b07332677cc56926262a3ecef25c382458ddcfcacb44e809a2e024c190ee",
"sha256": "4fe340696d04d6e55187c4abe683d0c61d2b15f17b45c0713983eb52d558afcc"
}
],
"package_integrity": [
{
"hashes": {
"md5": "72df32d0e09323a13aa3cc9251e902e9",
"sha256": "0df96d2c6ec54d2f9d45b9bad705b99108fc1d5f5de0bf1baf5c3ba9c975fe2f",
"blake2b_256": "f8b2e76b7727980d1ed06d766d0293f45ae1432fd5380d3d883d7d2f3af902a3"
},
"filename": "claudedashbord-0.1.3.tar.gz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #23702 · Revision 1
- Added to Heist Feed
- Publisher date