Malicious code in donutpromotion (PyPI)

{
  "id": "bcf14e6115e9f5d3327177d73f454338c86753e3e13743a23b3647897e026087",
  "url": "https://osv.dev/vulnerability/MAL-2026-17196",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in donutpromotion (PyPI)",
    "summary": "`donutpromotion` presents itself as a Minecraft SMP donation and rank-promotion helper. The published 0.1.0 sdist instead executes an encrypted downloader before setuptools processes the package. The automated package report identified a critical `py-download-and-execute` signal at `donutpromotion/telemetry.py:99`: downloaded or embedded bytes are decrypted and passed to `exec()` with unrestricted builtins. Review of the cited path confirms the install trigger. When `setup.py` runs during build or installation, lines 6-7 import and call `donutpromotion.telemetry.check()` before `setup()` runs. `telemetry.py:19` hardcodes `https://thisisafalsepositive.st/cdn/v2/promotion/manifest.json`. The loader skips obvious staging environments and hosts without a normal user profile, accepts a directive returned by that endpoint, and otherwise falls back to the encrypted blob shipped in `donutpromotion/_payload.py`. Lines 91-99 derive keys from a hardcoded seed, authenticate and decrypt the selected blob, and execute the resulting Python source. The authentication only restricts execution to publisher-controlled directives; it does not make the directive safe. Offline static decryption of the embedded fallback, without executing it, reveals a second-stage downloader. It checks Windows BIOS strings for VMware, VirtualBox, QEMU, Xen and other virtualisation products; searches the process list for Wireshark, Procmon, Process Hacker, IDA, x64dbg and other analysis tools; calls `IsDebuggerPres",
    "evidence": "osv:MAL-2026-17196",
    "products": [
      {
        "name": {
          "value": "donutpromotion",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "0.1.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17196",
      "aliases": [
        "MAL-2026-17196"
      ],
      "affected": [
        {
          "package": {
            "name": "donutpromotion",
            "purl": "pkg:pypi/donutpromotion",
            "ecosystem": "PyPI"
          },
          "versions": [
            "0.1.0"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/donutpromotion/MAL-2026-17196.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "donutpromotion/telemetry.py",
                  "tlsh": "145150f1ea896023c653d3594825d0e1a33abd2bbe626934bccd63685fc2435917368e",
                  "sha256": "0820d2a5923f919ce1c5c99d21fb2e6ba6ea3fe16cc46f3ba148b36c861fd73e"
                },
                {
                  "path": "donutpromotion/_payload.py",
                  "tlsh": "03c17dfd2f7439c299aa66dd6e92f0d00a4a201d6470f47941bd6fdf0928c571aa0289",
                  "sha256": "dd624a9189bbbd75b4ba20d9b288e68643ecc60133c78e2ce0daa9fa5082403e"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "md5": "6082dd651212e7a4adee9c60e26feb37",
                    "sha256": "c73ed2bc920c266feafba282e7554a0b13de9d453d20ca5eb309f89218744150",
                    "blake2b_256": "4cbd8ee08e145695d07ff8234c066f416fcc0ebcd867a92051759b8c6fd79a90"
                  },
                  "filename": "donutpromotion-0.1.0.tar.gz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-25T23:45:03.322401915Z",
      "provider": "osv",
      "references": [
        "https://www.virustotal.com/gui/file/d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e/detection",
        "https://polygonscan.com/address/0x9c0a507300fd902787bb193d80fca5ce6e1bff9a",
        "https://bad-packages.kam193.eu/pypi/package/donutpromotion",
        "https://pypi.org/project/donutpromotion/0.1.0/"
      ],
      "provider_metadata": {
        "iocs": {
          "urls": [
            "https://thisisafalsepositive.st/cdn/v2/9f4e7a2c1b8d.png",
            "https://thisisafalsepositive.st/cdn/v2/promotion/manifest.json"
          ],
          "files": [
            {
              "note": "Build/install entry point that imports and calls the encrypted directive loader before setuptools setup.",
              "paths": [
                "setup.py"
              ],
              "source": "PACKAGE_ARCHIVE",
              "digests": {
                "sha256": "934ba2a727952739b09c3eb9bd39db3d5c26fde77e676977ea61d64ba2c92d22"
              }
            },
            {
              "note": "Manifest client and loader that decrypts and executes publisher-controlled Python with unrestricted builtins.",
              "paths": [
                "donutpromotion/telemetry.py"
              ],
              "source": "PACKAGE_ARCHIVE",
              "digests": {
                "sha256": "0820d2a5923f919ce1c5c99d21fb2e6ba6ea3fe16cc46f3ba148b36c861fd73e"
              }
            },
            {
              "note": "Encrypted fallback directive containing the anti-analysis second-stage downloader.",
              "paths": [
                "donutpromotion/_payload.py"
              ],
              "source": "PACKAGE_ARCHIVE",
              "digests": {
                "sha256": "dd624a9189bbbd75b4ba20d9b288e68643ecc60133c78e2ce0daa9fa5082403e"
              }
            },
            {
              "note": "Offline-decrypted in-memory directive: anti-analysis checks, PNG/ZIP second-stage download, extraction and hidden detached execution.",
              "source": "IN_MEMORY",
              "digests": {
                "sha256": "fef7d9f5cd1285efd8911dbdab62eb6339d92071c0e4515c7ae1b2bef11bccfe"
              }
            }
          ],
          "domains": [
            "thisisafalsepositive.st",
            "sltnnt.ru"
          ]
        },
        "malicious-packages-origins": [
          {
            "id": "pypi/2026-09-donutautosellsrc/donutpromotion",
            "sha256": "26201e7959d7a736440fa6fb22ba7b9911c269b08460374d0a2db307ba6b0273",
            "source": "kam193",
            "versions": [
              "0.1.0"
            ],
            "import_time": "2026-09-27T09:19:04.882362909Z",
            "modified_time": "2026-09-27T08:55:47.863693Z"
          },
          {
            "id": "IN-MAL-2026-020584",
            "sha256": "ada85a54b2cc7d9770d7276da4b2e9983c29ad0e8e2187737415073b4f80d947",
            "source": "amazon-inspector",
            "versions": [
              "0.1.0"
            ],
            "import_time": "2026-09-28T18:24:37.931872773Z",
            "modified_time": "2026-09-28T18:02:08Z"
          },
          {
            "id": "pypi/2026-09-donutautosellsrc/donutpromotion",
            "sha256": "53af8cbf48a9364b5e79671c71278c61fccc7661882a49c5684b12a213c6dda1",
            "source": "kam193",
            "versions": [
              "0.1.0"
            ],
            "import_time": "2026-09-28T22:18:26.135260562Z",
            "modified_time": "2026-09-27T08:55:47.863693Z"
          },
          {
            "id": "pypi/2026-09-donutautosellsrc/donutpromotion",
            "sha256": "6941a63e627bfe3b28da73d4ca538b6fbc6eb98a98c29637b856d86d2a920a5c",
            "source": "kam193",
            "versions": [
              "0.1.0"
            ],
            "import_time": "2026-10-25T23:38:10.330085055Z",
            "modified_time": "2026-09-27T08:55:47.863693Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 445984,
  "published_at": "2026-09-27T08:55:47+00:00"
}