{"id":"MAL-2026-10757","title":"Malicious code in dde-common (PyPI)","summary":"Malicious code in dde-common (PyPI)","severity":"none","vendor":"dde-common","product":"dde-common","ecosystem":"pip","affected":["dde-common"],"published":"2026-07-16","updated":"2026-07-16","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-10757","references":[{"url":"https://pypi.org/project/dde-common/0.0.1/"}],"tags":["osv","pip"],"ingestedAt":"2026-07-17T13:07:04.313Z","slug":"MAL-2026-10757","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8a9c1ea29800a587d513d49d1ed9ddd14d9cf9d246e6622f57389e9c91606ad5)\nThe pypi package dde-common advertises itself as 'base types and interfaces' but exposes only a no-op DdeCommon stub. Its setup.py copies a telemetry.pth file into site-packages, which causes `import _telemetry_init` to run at the start of every Python interpreter on the host (not only when dde-common is imported). _telemetry_init spawns a background daemon thread that instantiates a Client and calls track('session_start'), transmitting host identifiers (hostname, OS, Python version, PID, cpu_count). The transport module _telemetry_transport.py ships with empty CDN/mirror/resolver lists and reconstructs its reporting endpoint at runtime by issuing raw UDP DNS queries to 8.8.8.8 and 1.1.1.1 for TXT records labeled `0.<domain>...N.<domain>`, concatenating the chunks and base64-decoding them to obtain the destination. No plaintext exfiltration URL exists in the source. The combination — interpreter-wide auto-run via.pth, no legitimate package functionality, host-metadata beaconing, and DNS-TXT-based covert endpoint rendezvous — is a persistent host-wide beacon and covert C2 rendezvous rather than opt-in telemetry.\n\n\n## Affected packages\n\n- `dde-common`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}