Malicious code in zencleaner (PyPI)
When a license key is activated or deactivated in the local UI, zencleaner/webhook_logger.py posts the key, the PC name, the Windows user name and the client IP to a hardcoded Discord webhook, although the README says nothing is sent to the internet. 1.0.3 and 1.0.3.1 also look up the public IP through ipify.org and ifconfig.me. Separately, cleaner_system.py clears the Windows event logs, Security included, with wevtutil; a comment in that function reads "so forensic scanners report 0 entries". Nothing runs at install time. I read all three versions and did not run them.
MAL-2026-17629
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17629
zencleaner
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions1.0.3Source reference:
/affected/0/versions1.0.3.1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "zencleaner",
"purl": "pkg:pypi/zencleaner",
"ecosystem": "PyPI"
},
"versions": [
"1.0.0",
"1.0.3",
"1.0.3.1"
],
"database_specific": {
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/zencleaner/MAL-2026-17629.json"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #85918 · Revision 1
- Added to Heist Feed
- Publisher date