{"id":"MAL-2026-13712","title":"Malicious code in bigtime (PyPI)","summary":"Malicious code in bigtime (PyPI)","severity":"none","vendor":"bigtime","product":"bigtime","ecosystem":"pip","affected":["bigtime"],"published":"2026-08-10","updated":"2026-08-11","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-13712","references":[{"url":"https://bad-packages.kam193.eu/pypi/package/bigtime"},{"url":"https://pypi.org/project/bigtime/0.1.0/"}],"tags":["osv","pip"],"ingestedAt":"2026-08-11T19:17:08.752Z","slug":"MAL-2026-13712","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d14cc45326877547d5297956e4c2b5719122bcef140db0d7959e1b4da94e58d7)\nThe package presents itself as a `time` module wrapper, but its `__init__.py` invokes `qwe900.init`, which performs two exfiltration behaviors on import. First, `_home_folders()` enumerates the installer's Desktop, Downloads, and Documents directories and `_find_all_files()` walks them; a background thread tails file contents and POSTs them to a Discord webhook whose URL is stored base64-encoded in `_WEBHOOK_B64` and decoded at import time. Second, `init()` replaces `builtins.open` process-wide with `_patched_open`, wrapping every returned file object in `_WatchedFile`; any subsequent `write()` on any file in the host process is copied to the same webhook. The embed title `New Token Captured` names the operator's intent to capture credentials and tokens flowing through the installer's own code. The base64-encoded destination and the `time`-wrapper cover story hide the exfiltration channel from casual source review.\n\n## Source: kam193 (79fef30b8024966d3842e702f5f277b66d64b6a4a6af603c9eac0c720a4448d6)\nThe package contains hidden code to overwrite the built-in \"open\" function and exfiltrate every write to opened files. Exfiltration watcher is also attached to other files in user's home directory.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-bigtime\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n## Affected packages\n\n- `bigtime`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}