mal-2026-16131

{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "src/aitextutils/text.py",
              "sha256": "d77fd359aff2ddaf5df761941d6b01fa1e6578394b22a1c4cecb8a3c169cf894",
              "tlsh": "60d13110fc6b6e49c572c41fac13a806f75813978811e99738fcc5a92ff94a686f4a9c"
            }
          ],
          "package_integrity": [
            {
              "filename": "aitextutils_py-0.1.1-py3-none-any.whl",
              "hashes": {
                "blake2b_256": "3ec206f55be36829a7642559c40b119296970215227376b21e6e2224286c70c2",
                "md5": "afe37399caebf9abb5f6b01b4e6b01d2",
                "sha256": "dc0ea02e0af2ce35239927cfe97806f1b5a431c0baee225ede24f1c77553230b"
              }
            },
            {
              "filename": "aitextutils_py-0.1.1.tar.gz",
              "hashes": {
                "blake2b_256": "589703ccd73d026b2fdcbdecb1e3ae91901bc59a779d4ab38935eafba59143f6",
                "md5": "ef49d5f0ba46ffddbbb250a96d07119d",
                "sha256": "72f025ae07e58af0c39559d2003bf8c85bc3b3ec0d66305de7e0e43eb772b913"
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "aitextutils-py"
      },
      "versions": [
        "0.1.0",
        "0.1.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Mańkowski (kam193)",
      "type": "REPORTER"
    }
  ],
  "database_specific": {
    "iocs": {
      "domains": [
        "ssbeatech.com",
        "anymeetly.com"
      ],
      "urls": [
        "https://ssbeatech.com/download/linux/install",
        "https://ssbeatech.com/download/linux.zip",
        "https://ssbeatech.com/download/win/install.ps1",
        "https://ssbeatech.com/download/v1.0.3/win.zip"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "pypi/2026-09-aitextkit-py/aitextutils-py",
        "import_time": "2026-09-11T16:19:45.182413356Z",
        "modified_time": "2026-09-11T15:24:15.064107Z",
        "sha256": "079adf053b093075a5d8151dbbb82bb85a45f577ae3a9f6e6c751a4779d52f77",
        "source": "kam193",
        "versions": [
          "0.1.0",
          "0.1.1"
        ]
      },
      {
        "id": "pypi/2026-09-aitextkit-py/aitextutils-py",
        "import_time": "2026-09-11T20:17:44.720377963Z",
        "modified_time": "2026-09-11T15:24:15.064107Z",
        "sha256": "59b5d893cd227654dae3bd7964e54ba20c99963660993e4239f34bba0d50b772",
        "source": "kam193",
        "versions": [
          "0.1.0",
          "0.1.1"
        ]
      },
      {
        "id": "IN-MAL-2026-020462",
        "import_time": "2026-09-23T05:18:36.19813674Z",
        "modified_time": "2026-09-23T05:10:42Z",
        "sha256": "d70c1bd80ce0363cc25271a25e742ebe8c4346c872456f78b1ac039ef4641a67",
        "source": "amazon-inspector",
        "versions": [
          "0.1.1"
        ]
      },
      {
        "id": "IN-MAL-2026-020460",
        "import_time": "2026-09-23T05:18:36.002250105Z",
        "modified_time": "2026-09-23T05:10:25Z",
        "sha256": "ff04f03a6bce7a49fff5faa5ac16230c1c1a31d847edadd0cc449237cf068365",
        "source": "amazon-inspector",
        "versions": [
          "0.1.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d70c1bd80ce0363cc25271a25e742ebe8c4346c872456f78b1ac039ef4641a67)\nThe package was found to contain malicious code or consuming dependency that contains malicious code\n\n## Source: kam193 (59b5d893cd227654dae3bd7964e54ba20c99963660993e4239f34bba0d50b772)\nThis package executes code from malicious dependency, which hides code downloading script, which then downloads and executes a heavily obfuscated final stage. The remote stages are hosted on a domain presenting a suspicious-looking corporate website. The downloaded code establishes persistence e.g. as \"anymeetly-cameradriver\" systemd service.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-aitextkit-py\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - Downloads and executes a remote malicious script.\n\n\n - persistence\n\n\n - infostealer\n\n\n - exfiltration-browser-data\n\n\n - rat\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n",
  "id": "MAL-2026-16131",
  "modified": "2026-09-23T05:20:43.493171867Z",
  "published": "2026-09-11T15:24:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.linkedin.com/company/ssbeatech/"
    },
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/aitextutils-py"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/aitextutils-py/0.1.1/"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/aitextutils-py/0.1.0/"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in aitextutils-py (PyPI)"
}