Skip to content
Heist/ feed
Unrated

Malicious code in sherpy (PyPI)

Type: advisorySource: OSV1 source record

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (561bac708df60298c46df70c27282912b3955ec3fd83a23e251c268e814cdcbf) The `sherpy` package presents itself as an OSINT command-line tool but ships all of its logic inside a 10.8 MB precompiled PyO3 native module at `sherpy/_core.abi3.so`. The Python surface is a trivial shim: `sherpy/__init__.py` is empty and `sherpy/cli.py` only forwards to three entry points in the native module — `osi()`, `send_tg_ar()`, and `send_tg_trt()`. The compiled crate manifest links `teloxide` (Telegram Bot API client), `reqwest`/`hyper` (HTTP), `dirs` (home-directory locators), `walkdir` (recursive filesystem enumeration), `zip` (archiving), and wallet-relevant cryptographic crates `aes`, `chacha20`, `bs58`, and `pbkdf2`, plus `windows-sys` for Windows host access. The `send_tg_*` naming combined with this dependency set matches a Telegram-bot exfiltration stealer: enumerate the user's home directory, collect wallet keystores and credential files, package them, and upload to an attacker-controlled Telegram bot whose token and chat ID are hardcoded inside the opaque binary. Running the advertised CLI therefore causes the installer's wallet and credential material to be exfiltrated to the author's Telegram endpoint. The behavior is hidden inside a compiled native module with no source shipped, defeating text-based source review. ## Source: kam193 (2e5440f1e24545fd14e73c7fc459a9abf893f4674683899ed29ff7c4189416b6) Wh

Announced Source revision 1
Original source ↗

MAL-2026-17188

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-17188

sherpy

Source reference: /affected/0/package/name

Affected versions
0.1.0

Source reference: /affected/0/versions

0.1.1

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "package": {
      "name": "sherpy",
      "purl": "pkg:pypi/sherpy",
      "ecosystem": "PyPI"
    },
    "versions": [
      "0.1.0",
      "0.1.1"
    ],
    "database_specific": {
      "cwes": [
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        }
      ],
      "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/sherpy/MAL-2026-17188.json",
      "indicators": {
        "evidence_files": [
          {
            "path": "sherpy/cli.py",
            "tlsh": "bae092201df11d26c353c4998434c2b45a97b997494b2437fcec826e2fc2132cab90af",
            "sha256": "34e16c15850ccae7132e1604634b8c82256cb4ea918d6a31f193b7e3b37b8beb"
          },
          {
            "path": "sherpy/_core.abi3.so",
            "tlsh": "d1b69e1bba1d6c1ec2c3b0bf8cad45641067b7503114c68a3c159e2efd96bd58a3b73a",
            "sha256": "735b9f9264b793f8856f7c8f78e71e89fd63cc5a7510b85c1ef40537a1ac4185"
          }
        ],
        "package_integrity": [
          {
            "hashes": {
              "md5": "00c30313b594f086c19371acb51fadba",
              "sha256": "4c735256e36853258a7670841141b46de72939cac0ceb27d8bb75aa96b4c8a15",
              "blake2b_256": "1ddfb24e4d0efc258a640374e7fff30216f0065bcf437df234b95b28c606a069"
            },
            "filename": "sherpy-0.1.1-cp39-abi3-macosx_11_0_arm64.whl"
          },
          {
            "hashes": {
              "md5": "58365cb5a67f1a2b23b8696b58810ef8",
              "sha256": "c2985cb89205ec486026eddcfbeae076a82b584acc53a846c7c22b3ab506f12b",
              "blake2b_256": "63ce97491debdedb294159e34ba75b80947337cac8e95a634ccb0777f9ea6343"
            },
            "filename": "sherpy-0.1.1-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
          },
          {
            "hashes": {
              "md5": "65de52b98bb9bb62389eb2f7a7675385",
              "sha256": "cb7656933965996b2b28b92af83065550dcd148487d1a79a060d2d81c9de800e",
              "blake2b_256": "cc453806d086f02b39a90f47e00759d5388423d49cc31fc33f0c039219fd8894"
            },
            "filename": "sherpy-0.1.1-cp39-abi3-win_amd64.whl"
          }
        ]
      }
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#23573 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement