{"id":"MAL-2026-10672","title":"Malicious code in northstart-sdk (PyPI)","summary":"Malicious code in northstart-sdk (PyPI)","severity":"none","vendor":"northstart-sdk","product":"northstart-sdk","ecosystem":"pip","affected":["northstart-sdk"],"published":"2026-07-15","updated":"2026-07-15","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-10672","references":[{"url":"https://bad-packages.kam193.eu/pypi/package/northstart-sdk"},{"url":"https://pypi.org/project/northstart-sdk/0.2.2/"},{"url":"https://pypi.org/project/northstart-sdk/0.2.0/"},{"url":"https://pypi.org/project/northstart-sdk/0.2.1/"}],"tags":["osv","pip"],"ingestedAt":"2026-07-15T14:42:17.947Z","slug":"MAL-2026-10672","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (aa58bcfb4f89faf624c1f99bb552e597cc2e061330a2e98e72e6f401bb70b4f9)\nThe pypi package northstart-sdk 0.2.1 executes attacker-controlled code as a side effect of `import northstart_sdk`. The top-level `__init__.py` assigns `AUTO_DEMO_RESULTS = _run_bundled_encrypted_demos()`, which fetches 8 bytes from a hardcoded Yuque CDN PNG (https://cdn.nlark.com/yuque/0/2026/png/12727464/...png), uses them as PBKDF2-HMAC-SHA256 key material (with a static PNG-signature fallback so the shipped ciphertext is decryptable offline), decrypts JSON blobs under `src/northstart_sdk/_encrypted_demos/`, and passes the decrypted bytes to `compile()` and `exec()` via `_execute_source`. The bespoke crypto + remote-key-fetch construction serves only to keep the exec'd payload out of source review. The plaintext progenitor of that payload is shipped in the same tree at `encry/whats.ak`: length-prefixed framed socket I/O (`s.sendall(struct.pack('>I', len(enc)))`, matching `s.recv` framing), XOR/AES-GCM/ChaCha20/Fernet routines, RSA-OAEP key exchange, and an auth-message builder that transmits user/password/id fields to a remote peer, with function names obfuscated and misleading `# API endpoint handler` / `# Health check endpoint` comments. Importing the package launches a remote-controlled agent that opens an encrypted framed connection to an operator-controlled socket.\n\n## Source: kam193 (3d6810f5c57750ef71c1a2ee0bc6516a3ba537caf263d8002cdd016623052d5a)\nThe package contains encrypted and obfuscated code that starts a custom reverse shell/command execution during module import.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-07-northstart-sdk\n\n\nReasons (based on the campaign):\n\n\n - targetted-attack\n\n\n - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.\n\n\n - obfuscation\n\n\n## Affected packages\n\n- `northstart-sdk`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}