Malicious code in ig-gox (PyPI)

{
  "id": "3f3aee63c06b328add8994651e4a339b1abeb310a48e905093c29a43a46e0cf4",
  "url": "https://osv.dev/vulnerability/MAL-2026-17712",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in ig-gox (PyPI)",
    "summary": "Importing ig_gox runs ig_gox/__init__.py, which decodes a blob (base64, XOR, zlib) after a few anti-debugging checks and execs it as __main__. The decoded loader only goes on if it looks like a physical Android device running Termux (it turns away x86, emulators and VMs), installs requests and cryptography if they are missing, downloads encrypted code from https://goxtools.shop/api/admin/storage.php, decrypts it with AES-256-CBC and runs it in memory. The README only calls it a runtime engine for Termux. I decoded the loader statically and did not see what the downloaded code does. I read 1.0.0 and did not run it. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9b31f8ba5b2167be45b02cd3bbf840873adf76369e3ac472f1cccfc4a0579fff) The pypi package ig-gox ships a top-level ig_gox/__init__.py that, on import (the README's documented usage), base64-decodes a ~5 KB embedded blob, XOR-decrypts it with a hardcoded key, zlib-decompresses it, HMAC-verifies it, then exec/compiles the resulting Python under __name__='__main__'. The visible wrapper has no other functionality; all actual behavior of the package is contained in that concealed blob. Before decoding, the module performs anti-analysis checks: it calls sys.exit(0) if sys.gettrace() returns a tracer, if the process environment/cwd/argv contain substrings such as 'uncompyle', 'pycdc', 'decompyle', 'deobfuscate', 'hook', or 'frida', and it tampers with references to builtins.exec/eval/compile.",
    "evidence": "osv:MAL-2026-17712",
    "products": [
      {
        "name": {
          "value": "ig-gox",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17712",
      "aliases": [
        "MAL-2026-17712"
      ],
      "affected": [
        {
          "package": {
            "name": "ig-gox",
            "purl": "pkg:pypi/ig-gox",
            "ecosystem": "PyPI"
          },
          "versions": [
            "1.0.0"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ig-gox/MAL-2026-17712.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "ig_gox/__init__.py",
                  "tlsh": "26029d000d8b18ac772854ed1206d96ce642d6cff0572a58bd9e2492afe1439d0a6ebf",
                  "sha256": "ba63e096bf53afc4bfe19863d767f2afda3f280b484614926ed54bfa4fc5bc5a"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "md5": "1db069868ae2beaed5135de236f62fcb",
                    "sha256": "60c9d54df93424745b88a586d2ee7e0e6bb4eb537c247e4cc60cfd435d67053a",
                    "blake2b_256": "7c1c65aded3ec369d1885c71531f9036d854a4cc868bc2a349f1e0b5469cb8a8"
                  },
                  "filename": "ig_gox-1.0.0-py3-none-any.whl"
                },
                {
                  "hashes": {
                    "md5": "69929f48eb26864f5f9ef4a1cc8ebabb",
                    "sha256": "abbc60f89180a06b6a1a25d8dbf53b41c74eded9a1a78cd1b7933c0e71044146",
                    "blake2b_256": "34ab4a8fc7060909dc964e3c5858f7b4ec7faad0c9b0948fcc9ac4801cc15b87"
                  },
                  "filename": "ig_gox-1.0.0.tar.gz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-12T05:00:07.234523916Z",
      "provider": "osv",
      "references": [
        "https://bad-packages.kam193.eu/pypi/package/ig-gox",
        "https://pypi.org/project/ig-gox/1.0.0/"
      ],
      "provider_metadata": {
        "iocs": {
          "urls": [
            "https://goxtools.shop/api/admin/storage.php"
          ],
          "domains": [
            "goxtools.shop"
          ]
        },
        "malicious-packages-origins": [
          {
            "id": "pypi/2026-10-ig-gox/ig-gox",
            "sha256": "780638a0747103eb44a85312a2cfb552981e498655f638c5baf86eb4a5f74042",
            "source": "kam193",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-10-09T09:47:28.468553955Z",
            "modified_time": "2026-10-09T09:21:11.264724Z"
          },
          {
            "id": "IN-MAL-2026-021430",
            "sha256": "9b31f8ba5b2167be45b02cd3bbf840873adf76369e3ac472f1cccfc4a0579fff",
            "source": "amazon-inspector",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-10-11T14:18:04.946361312Z",
            "modified_time": "2026-10-11T13:58:22Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 298596,
  "published_at": "2026-10-09T02:53:23+00:00"
}