Skip to content
Heist/ feed
Back to feed
Unrated

Malicious code in ukraine69 (PyPI)

Type: advisorySources: OSV

Importing `ukraine69` in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local `.vault` files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts `account.deleteAccount` using GoyGram, with a Telethon fallback in versions 1.2.5–1.2.8. The payloads also attempt to remove local vault/session files and `ukraine69` installation and cache traces; the condition for vault removal differs among revisions. Versions 1.2.5–1.2.8 specifically target Hotaru session vault layouts, and 1.2.7–1.2.8 additionally try `auth.checkPassword` if a password is present in the vault. Version 1.2.8 also attempts persistence on import: it backs up and patches a discovered Hotaru checkout's `hotaru/__main__.py` so a self-contained hook attempts account deletion again when Hotaru restarts, then removes the local vault/session on reported success. Version 1.2.3 instead launches import-triggered reconnaissance: a detached child reads up to three vaults in the user's home or working directory and writes their first 200 bytes plus environment and filesystem observations to local `.u69_recon.log` files. No external exfiltration or account-deletion call appears in 1.2.3. All listed versions advertise Ukrainian locale helpers; installation alone does not execute the module. Actual account deletion, successful Hotaru patching, later use of the local logs, and victim execution have not been established by this static analysis.

Products
ukraine69
Affected versions
1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.5, 1.2.6, 1.2.7, 1.2.8
Fixed versions
Not specified
CVEs
Not specified
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 10:35 UTC · Revision 1

Source evidence

Malicious code in ukraine69 (PyPI)

core-osv · Original source

Published 17 Oct 2026, 16:53 UTC

Importing `ukraine69` in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local `.vault` files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts `account.deleteAccount` using GoyGram, with a Telethon fallback in versions 1.2.5–1.2.8. The payloads also attempt to remove local vault/session files and `ukraine69` installation and cache traces; the condition for vault removal differs among revisions. Versions 1.2.5–1.2.8 specifically target Hotaru session vault layouts, and 1.2.7–1.2.8 additionally try `auth.checkPassword` if a password is present in the vault. Version 1.2.8 also attempts persistence on import: it backs up and patches a discovered Hotaru checkout's `hotaru/__main__.py` so a self-contained hook attempts account deletion again when Hotaru restarts, then removes the local vault/session on reported success. Version 1.2.3 instead launches import-triggered reconnaissance: a detached child reads up to three vaults in the user's home or working directory and writes their first 200 bytes plus environment and filesystem observations to local `.u69_recon.log` files. No external exfiltration or account-deletion call appears in 1.2.3. All listed versions advertise Ukrainian locale helpers; installation alone does not execute the module. Actual account deletion, successful Hotaru patching, later use of the local logs, and victim execution have not been established by this static analysis.

osv:MAL-2026-17919

ukraine69

Fixed versions: Not specified

Complete source record
{
  "id": "c5289db6d627ba5183c2a8bf389d11ff811adf9021ea2173cbdfb21b27165dba",
  "url": "https://osv.dev/vulnerability/MAL-2026-17919",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in ukraine69 (PyPI)",
    "summary": "Importing `ukraine69` in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local `.vault` files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts `account.deleteAccount` using GoyGram, with a Telethon fallback in versions 1.2.5–1.2.8. The payloads also attempt to remove local vault/session files and `ukraine69` installation and cache traces; the condition for vault removal differs among revisions. Versions 1.2.5–1.2.8 specifically target Hotaru session vault layouts, and 1.2.7–1.2.8 additionally try `auth.checkPassword` if a password is present in the vault. Version 1.2.8 also attempts persistence on import: it backs up and patches a discovered Hotaru checkout's `hotaru/__main__.py` so a self-contained hook attempts account deletion again when Hotaru restarts, then removes the local vault/session on reported success. Version 1.2.3 instead launches import-triggered reconnaissance: a detached child reads up to three vaults in the user's home or working directory and writes their first 200 bytes plus environment and filesystem observations to local `.u69_recon.log` files. No external exfiltration or account-deletion call appears in 1.2.3. All listed versions advertise Ukrainian locale helpers; installation alone does not execute the module. Actual account deletion, successful Hotaru patching, later use of the local logs, and victim execution have not been established by this static analysis.",
    "evidence": "osv:MAL-2026-17919",
    "products": [
      {
        "name": {
          "value": "ukraine69",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.2.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.2.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.2.2",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.2.3",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.2.5",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.2.6",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.2.7",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.2.8",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17919",
      "aliases": [
        "MAL-2026-17919"
      ],
      "affected": [
        {
          "package": {
            "name": "ukraine69",
            "purl": "pkg:pypi/ukraine69",
            "ecosystem": "PyPI"
          },
          "versions": [
            "1.2.0",
            "1.2.1",
            "1.2.2",
            "1.2.3",
            "1.2.5",
            "1.2.6",
            "1.2.7",
            "1.2.8"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ukraine69/MAL-2026-17919.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "ukraine69/__init__.py",
                  "tlsh": "b5f18620a4125823e347ea5e4916d0e02b1eb977350a5d74b9fc7e44ffcd6b182b46bc",
                  "sha256": "6b36b90468c442a02d0cc6aaf3b401a96d54d34d85f6aac49b2bcb074aea44e6"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "md5": "e57c3121790dc1bbf5ed5da734bd5660",
                    "sha256": "576037f8bd79689977cdb4528b188acfe53f773025dac244825a08620ce8dfa0",
                    "blake2b_256": "94923895a2d5a934ea9f9c05d9f316d7bca905eb3fac863fdf3051aa14e4277b"
                  },
                  "filename": "ukraine69-1.2.1-py3-none-any.whl"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-26T06:45:16.054574101Z",
      "provider": "osv",
      "references": [
        "https://bad-packages.kam193.eu/pypi/package/ukraine69",
        "https://pypi.org/project/ukraine69/1.2.1/",
        "https://pypi.org/project/ukraine69/1.2.6/",
        "https://pypi.org/project/ukraine69/1.2.0/",
        "https://pypi.org/project/ukraine69/1.2.2/",
        "https://pypi.org/project/ukraine69/1.2.8/",
        "https://pypi.org/project/ukraine69/1.2.7/",
        "https://pypi.org/project/ukraine69/1.2.5/",
        "https://inspector.pypi.io/project/ukraine69/1.2.0/packages/2c/3f/e51de071990c6e81c9f9d59b7adde323fd0dacd0e52961513ccae945aeb6/ukraine69-1.2.0-py3-none-any.whl/ukraine69/__init__.py#line.208",
        "https://inspector.pypi.io/project/ukraine69/1.2.1/packages/94/92/3895a2d5a934ea9f9c05d9f316d7bca905eb3fac863fdf3051aa14e4277b/ukraine69-1.2.1-py3-none-any.whl/ukraine69/__init__.py#line.208",
        "https://inspector.pypi.io/project/ukraine69/1.2.2/packages/45/be/70b11f7a1065b918fff7e273a8929cfec6117ba10f6da1b9651d6fc6b0a9/ukraine69-1.2.2-py3-none-any.whl/ukraine69/__init__.py#line.221",
        "https://inspector.pypi.io/project/ukraine69/1.2.3/packages/69/a0/b71eda561d5b482f528b562285e74dbdbc74a4879d1b328f3c5712f42621/ukraine69-1.2.3-py3-none-any.whl/ukraine69/__init__.py#line.120",
        "https://inspector.pypi.io/project/ukraine69/1.2.5/packages/98/2a/40f168e0a9989e6c72650df04f7ec3cc0b4e11481b5d987c7c6990d294b2/ukraine69-1.2.5-py3-none-any.whl/ukraine69/__init__.py#line.321",
        "https://inspector.pypi.io/project/ukraine69/1.2.6/packages/40/65/cf3c297418f42056da1aa1ac74dee1a2ada2bc9e7048701429acd6fb17f2/ukraine69-1.2.6-py3-none-any.whl/ukraine69/__init__.py#line.354",
        "https://inspector.pypi.io/project/ukraine69/1.2.7/packages/1e/b8/421ab6c05f83983a337619596ad8e40126aa6319afdc91d73865da43ff8e/ukraine69-1.2.7-py3-none-any.whl/ukraine69/__init__.py#line.406",
        "https://inspector.pypi.io/project/ukraine69/1.2.8/packages/64/23/da183671983a86a4c92daffd479996dc61e50c93ac6f73d62083294dec4d/ukraine69-1.2.8-py3-none-any.whl/ukraine69/__init__.py#line.861",
        "https://pypi.org/project/ukraine69/1.2.3/"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "pypi/2026-10-ukraine69/ukraine69",
            "sha256": "751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a",
            "source": "kam193",
            "versions": [
              "1.2.0",
              "1.2.1",
              "1.2.2",
              "1.2.3",
              "1.2.5",
              "1.2.6",
              "1.2.7",
              "1.2.8"
            ],
            "import_time": "2026-10-17T17:38:26.306032386Z",
            "modified_time": "2026-10-17T16:53:55.661733Z"
          },
          {
            "id": "IN-MAL-2026-021519",
            "sha256": "33f42716a2bf353999fae2be805c5c9ca6ad9811920ee2ccec733a0647120831",
            "source": "amazon-inspector",
            "versions": [
              "1.2.1"
            ],
            "import_time": "2026-10-18T01:52:23.72296384Z",
            "modified_time": "2026-10-18T01:49:53Z"
          },
          {
            "id": "IN-MAL-2026-021515",
            "sha256": "4b8244951c9ae4f7baac94c3e7fd803e3c3ceaa27d64c2561cce098bd9dddf77",
            "source": "amazon-inspector",
            "versions": [
              "1.2.6"
            ],
            "import_time": "2026-10-18T01:52:23.398656642Z",
            "modified_time": "2026-10-18T01:49:18Z"
          },
          {
            "id": "IN-MAL-2026-021522",
            "sha256": "802aefe7084d5b846d6d2dec2b00c6c59c3ffd95e5c8a674653cf8c16e0558aa",
            "source": "amazon-inspector",
            "versions": [
              "1.2.0"
            ],
            "import_time": "2026-10-18T01:52:23.961292396Z",
            "modified_time": "2026-10-18T01:50:15Z"
          },
          {
            "id": "IN-MAL-2026-021521",
            "sha256": "8e933b1d75adc3025a2cb071396e7db13f81da48da6a23bf4a84b2955e80d032",
            "source": "amazon-inspector",
            "versions": [
              "1.2.2"
            ],
            "import_time": "2026-10-18T01:52:23.881468368Z",
            "modified_time": "2026-10-18T01:50:05Z"
          },
          {
            "id": "IN-MAL-2026-021518",
            "sha256": "9d6ffd39c8600f034e5e15148b7bbbab5b3d4454d3b0cb3a04af071af017e9d9",
            "source": "amazon-inspector",
            "versions": [
              "1.2.8"
            ],
            "import_time": "2026-10-18T01:52:23.635032435Z",
            "modified_time": "2026-10-18T01:49:43Z"
          },
          {
            "id": "IN-MAL-2026-021517",
            "sha256": "ad925525ff7c3ccbb1e6859728387aeaf83681aa88829eda1406e70338f64b7e",
            "source": "amazon-inspector",
            "versions": [
              "1.2.7"
            ],
            "import_time": "2026-10-18T01:52:23.556233738Z",
            "modified_time": "2026-10-18T01:49:35Z"
          },
          {
            "id": "IN-MAL-2026-021516",
            "sha256": "dff8e4c0a3df260243f56e218dce6c7092138e26578f8395fdeca348041835ce",
            "source": "amazon-inspector",
            "versions": [
              "1.2.5"
            ],
            "import_time": "2026-10-18T01:52:23.478882569Z",
            "modified_time": "2026-10-18T01:49:29Z"
          },
          {
            "id": "IN-MAL-2026-021782",
            "sha256": "e83671739340bc474342bdad3264ae2fcb06374c72de34bdd57791ce9c355dbf",
            "source": "amazon-inspector",
            "versions": [
              "1.2.3"
            ],
            "import_time": "2026-10-26T06:39:42.678592814Z",
            "modified_time": "2026-10-26T06:32:08Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 446739,
  "published_at": "2026-10-17T16:53:55+00:00"
}