{
  "schema_version": "1.7.4",
  "id": "MAL-2026-17919",
  "published": "2026-10-17T16:53:55Z",
  "modified": "2026-10-19T00:41:45.197192069Z",
  "summary": "Malicious code in ukraine69 (PyPI)",
  "details": "Importing `ukraine69` in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local `.vault` files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts `account.deleteAccount` using GoyGram, with a Telethon fallback in versions 1.2.5–1.2.8. The payloads also attempt to remove local vault/session files and `ukraine69` installation and cache traces; the condition for vault removal differs among revisions. Versions 1.2.5–1.2.8 specifically target Hotaru session vault layouts, and 1.2.7–1.2.8 additionally try `auth.checkPassword` if a password is present in the vault. Version 1.2.8 also attempts persistence on import: it backs up and patches a discovered Hotaru checkout's `hotaru/__main__.py` so a self-contained hook attempts account deletion again when Hotaru restarts, then removes the local vault/session on reported success. Version 1.2.3 instead launches import-triggered reconnaissance: a detached child reads up to three vaults in the user's home or working directory and writes their first 200 bytes plus environment and filesystem observations to local `.u69_recon.log` files. No external exfiltration or account-deletion call appears in 1.2.3. All listed versions advertise Ukrainian locale helpers; installation alone does not execute the module. Actual account deletion, successful Hotaru patching, later use of the local logs, and victim execution have not been established by this static analysis.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4b8244951c9ae4f7baac94c3e7fd803e3c3ceaa27d64c2561cce098bd9dddf77)\nThe package's __init__.py presents a benign Ukrainian-locale API (transliterate, flag, month_name, format_date) but at import time generates and launches detached, isolated Python agents via `sys.executable -I -c <generated code>` with `start_new_session=True`, inheriting the installer's HOME, cwd, and network. The spawned agents glob the installer's filesystem (`~/.hotaru/**`, `~/.local/share/hotaru/**`, `~/**/*.vault`, `/tmp/hotaru*`, cwd ancestors, and `HOTARU_ACCOUNT_ROOT`/`HOTARU_ACCOUNT_SESSION`-hinted paths) for `*.vault` files, decrypt them via `goygram.security._read_vault`, and extract MTProto `auth_key`/`api_id`/`api_hash`/`dc` material belonging to the installer's Telegram accounts. Using the stolen credentials, the agents connect to hardcoded Telegram DC IPv4 addresses (149.154.175.53, 149.154.167.51, 149.154.175.100, 149.154.167.91, 91.108.56.130) and invoke `account.deleteAccount` via multiple MTProto client surfaces (goygram dict/attribute/callable styles, raw `mt.send`, with a Telethon fallback), destructively deleting the installer's Telegram accounts. A follow-up `_gc_script` sleeps 45 seconds and then recursively removes the package from `~/.cache/hotaru/module-deps/<id>/`, `~/.cache/pip/wheels`, `~/.cache/pip/http-v2`, `~/.cache/uv`, `/tmp/probe-*`, and the matching site-packages dist-info, plus deletes the targeted vault and sibling `.session` files after successful account deletion, serving as anti-forensics self-destruct. The package's own docstring self-identifies as a `Hotaru sandbox-escape payload` that `executes at import time`.\n\n## Source: kam193 (751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a)\nDuring import, package performs actions intended to escape sandbox, find Telegram-bot session files and initiate malicious account deletion.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-ukraine69\n\n\nReasons (based on the campaign):\n\n\n - destructive-actions\n\n\n - covering-tracks\n",
  "affected": [
    {
      "package": {
        "name": "ukraine69",
        "ecosystem": "PyPI"
      },
      "versions": [
        "1.2.0",
        "1.2.1",
        "1.2.2",
        "1.2.3",
        "1.2.5",
        "1.2.6",
        "1.2.7",
        "1.2.8"
      ],
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "ukraine69/__init__.py",
              "sha256": "6b36b90468c442a02d0cc6aaf3b401a96d54d34d85f6aac49b2bcb074aea44e6",
              "tlsh": "b5f18620a4125823e347ea5e4916d0e02b1eb977350a5d74b9fc7e44ffcd6b182b46bc"
            }
          ],
          "package_integrity": [
            {
              "filename": "ukraine69-1.2.1-py3-none-any.whl",
              "hashes": {
                "blake2b_256": "94923895a2d5a934ea9f9c05d9f316d7bca905eb3fac863fdf3051aa14e4277b",
                "md5": "e57c3121790dc1bbf5ed5da734bd5660",
                "sha256": "576037f8bd79689977cdb4528b188acfe53f773025dac244825a08620ce8dfa0"
              }
            }
          ]
        }
      }
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/ukraine69"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/ukraine69/1.2.1/"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/ukraine69/1.2.6/"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/ukraine69/1.2.0/"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/ukraine69/1.2.2/"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/ukraine69/1.2.8/"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/ukraine69/1.2.7/"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/ukraine69/1.2.5/"
    },
    {
      "type": "EVIDENCE",
      "url": "https://inspector.pypi.io/project/ukraine69/1.2.0/packages/2c/3f/e51de071990c6e81c9f9d59b7adde323fd0dacd0e52961513ccae945aeb6/ukraine69-1.2.0-py3-none-any.whl/ukraine69/__init__.py#line.208"
    },
    {
      "type": "EVIDENCE",
      "url": "https://inspector.pypi.io/project/ukraine69/1.2.1/packages/94/92/3895a2d5a934ea9f9c05d9f316d7bca905eb3fac863fdf3051aa14e4277b/ukraine69-1.2.1-py3-none-any.whl/ukraine69/__init__.py#line.208"
    },
    {
      "type": "EVIDENCE",
      "url": "https://inspector.pypi.io/project/ukraine69/1.2.2/packages/45/be/70b11f7a1065b918fff7e273a8929cfec6117ba10f6da1b9651d6fc6b0a9/ukraine69-1.2.2-py3-none-any.whl/ukraine69/__init__.py#line.221"
    },
    {
      "type": "EVIDENCE",
      "url": "https://inspector.pypi.io/project/ukraine69/1.2.3/packages/69/a0/b71eda561d5b482f528b562285e74dbdbc74a4879d1b328f3c5712f42621/ukraine69-1.2.3-py3-none-any.whl/ukraine69/__init__.py#line.120"
    },
    {
      "type": "EVIDENCE",
      "url": "https://inspector.pypi.io/project/ukraine69/1.2.5/packages/98/2a/40f168e0a9989e6c72650df04f7ec3cc0b4e11481b5d987c7c6990d294b2/ukraine69-1.2.5-py3-none-any.whl/ukraine69/__init__.py#line.321"
    },
    {
      "type": "EVIDENCE",
      "url": "https://inspector.pypi.io/project/ukraine69/1.2.6/packages/40/65/cf3c297418f42056da1aa1ac74dee1a2ada2bc9e7048701429acd6fb17f2/ukraine69-1.2.6-py3-none-any.whl/ukraine69/__init__.py#line.354"
    },
    {
      "type": "EVIDENCE",
      "url": "https://inspector.pypi.io/project/ukraine69/1.2.7/packages/1e/b8/421ab6c05f83983a337619596ad8e40126aa6319afdc91d73865da43ff8e/ukraine69-1.2.7-py3-none-any.whl/ukraine69/__init__.py#line.406"
    },
    {
      "type": "EVIDENCE",
      "url": "https://inspector.pypi.io/project/ukraine69/1.2.8/packages/64/23/da183671983a86a4c92daffd479996dc61e50c93ac6f73d62083294dec4d/ukraine69-1.2.8-py3-none-any.whl/ukraine69/__init__.py#line.861"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "pypi/2026-10-ukraine69/ukraine69",
        "import_time": "2026-10-17T17:38:26.306032386Z",
        "modified_time": "2026-10-17T16:53:55.661733Z",
        "sha256": "751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a",
        "source": "kam193",
        "versions": [
          "1.2.0",
          "1.2.1",
          "1.2.2",
          "1.2.3",
          "1.2.5",
          "1.2.6",
          "1.2.7",
          "1.2.8"
        ]
      },
      {
        "id": "IN-MAL-2026-021519",
        "import_time": "2026-10-18T01:52:23.72296384Z",
        "modified_time": "2026-10-18T01:49:53Z",
        "sha256": "33f42716a2bf353999fae2be805c5c9ca6ad9811920ee2ccec733a0647120831",
        "source": "amazon-inspector",
        "versions": [
          "1.2.1"
        ]
      },
      {
        "id": "IN-MAL-2026-021515",
        "import_time": "2026-10-18T01:52:23.398656642Z",
        "modified_time": "2026-10-18T01:49:18Z",
        "sha256": "4b8244951c9ae4f7baac94c3e7fd803e3c3ceaa27d64c2561cce098bd9dddf77",
        "source": "amazon-inspector",
        "versions": [
          "1.2.6"
        ]
      },
      {
        "id": "IN-MAL-2026-021522",
        "import_time": "2026-10-18T01:52:23.961292396Z",
        "modified_time": "2026-10-18T01:50:15Z",
        "sha256": "802aefe7084d5b846d6d2dec2b00c6c59c3ffd95e5c8a674653cf8c16e0558aa",
        "source": "amazon-inspector",
        "versions": [
          "1.2.0"
        ]
      },
      {
        "id": "IN-MAL-2026-021521",
        "import_time": "2026-10-18T01:52:23.881468368Z",
        "modified_time": "2026-10-18T01:50:05Z",
        "sha256": "8e933b1d75adc3025a2cb071396e7db13f81da48da6a23bf4a84b2955e80d032",
        "source": "amazon-inspector",
        "versions": [
          "1.2.2"
        ]
      },
      {
        "id": "IN-MAL-2026-021518",
        "import_time": "2026-10-18T01:52:23.635032435Z",
        "modified_time": "2026-10-18T01:49:43Z",
        "sha256": "9d6ffd39c8600f034e5e15148b7bbbab5b3d4454d3b0cb3a04af071af017e9d9",
        "source": "amazon-inspector",
        "versions": [
          "1.2.8"
        ]
      },
      {
        "id": "IN-MAL-2026-021517",
        "import_time": "2026-10-18T01:52:23.556233738Z",
        "modified_time": "2026-10-18T01:49:35Z",
        "sha256": "ad925525ff7c3ccbb1e6859728387aeaf83681aa88829eda1406e70338f64b7e",
        "source": "amazon-inspector",
        "versions": [
          "1.2.7"
        ]
      },
      {
        "id": "IN-MAL-2026-021516",
        "import_time": "2026-10-18T01:52:23.478882569Z",
        "modified_time": "2026-10-18T01:49:29Z",
        "sha256": "dff8e4c0a3df260243f56e218dce6c7092138e26578f8395fdeca348041835ce",
        "source": "amazon-inspector",
        "versions": [
          "1.2.5"
        ]
      }
    ]
  },
  "credits": [
    {
      "name": "Amazon Inspector",
      "contact": [
        "inspector-research@amazon.com"
      ],
      "type": "FINDER"
    },
    {
      "name": "ESTsecurity",
      "contact": [
        "https://www.estsecurity.com/"
      ],
      "type": "FINDER"
    },
    {
      "name": "Kamil Mańkowski (kam193)",
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "type": "REPORTER"
    }
  ]
}