{"id":"MAL-2026-10755","title":"Malicious code in captcha-solve-api (PyPI)","summary":"Malicious code in captcha-solve-api (PyPI)","severity":"none","vendor":"captcha-solve-api","product":"captcha-solve-api","ecosystem":"pip","affected":["captcha-solve-api"],"published":"2026-07-16","updated":"2026-07-16","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-10755","references":[{"url":"https://pypi.org/project/captcha-solve-api/0.0.1/"}],"tags":["osv","pip"],"ingestedAt":"2026-07-17T13:07:04.263Z","slug":"MAL-2026-10755","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ee854f4888e58f81b9e22e7addd740d28a717be453133c10267dd91fc5e50cee)\nThe package advertises itself as a REST client for a captcha-solving API, but the shipped captcha_solve_api module is a ~20-line stub. The tarball's real payload is two top-level modules (_telemetry_init, _telemetry_transport, ~117 KB) installed as global site modules together with a telemetry.pth file copied into site-packages by a custom install command. The.pth contains `import _telemetry_init`, which Python auto-executes on every interpreter start — independent of whether captcha_solve_api is ever imported. _telemetry_init spawns a daemon thread that instantiates _telemetry_transport.Client and calls initialize()/track(). The runtime collects host identifiers (platform.node() hostname, cpu_count, OS/arch, Python version, session identifiers) and POSTs JSON envelopes to /api/envelope on a destination host that is not hardcoded: a ServiceDiscovery class issues DNS TXT queries to 8.8.8.8 and 1.1.1.1 and base64-decodes concatenated TXT chunks to reconstruct the endpoint, allowing the operator to rotate destinations after install and evade domain/IP allowlists. Author metadata is a generic placeholder ('Platform Engineering') and the DSN docstring uses dev@example.com. The 'telemetry'/'analytics SDK' framing does not match the advertised captcha-solving purpose and is not part of the captcha_solve_api namespace.\n\n\n## Affected packages\n\n- `captcha-solve-api`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}