{"id":"MAL-2026-17919","title":"Malicious code in ukraine69 (PyPI)","summary":"Malicious code in ukraine69 (PyPI)","severity":"critical","exploited":true,"vendor":"ukraine69","product":"ukraine69","ecosystem":"pip","affected":["ukraine69"],"published":"2026-10-17","updated":"2026-10-18","sourceUpdated":"2026-10-18T02:00:13.219086812Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17919","references":[{"url":"https://bad-packages.kam193.eu/pypi/package/ukraine69"},{"url":"https://pypi.org/project/ukraine69/1.2.1/"},{"url":"https://pypi.org/project/ukraine69/1.2.6/"},{"url":"https://pypi.org/project/ukraine69/1.2.0/"},{"url":"https://pypi.org/project/ukraine69/1.2.2/"},{"url":"https://pypi.org/project/ukraine69/1.2.8/"},{"url":"https://pypi.org/project/ukraine69/1.2.7/"},{"url":"https://pypi.org/project/ukraine69/1.2.5/"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-10-18T11:51:09.854Z","slug":"MAL-2026-17919","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4b8244951c9ae4f7baac94c3e7fd803e3c3ceaa27d64c2561cce098bd9dddf77)\nThe package's __init__.py presents a benign Ukrainian-locale API (transliterate, flag, month_name, format_date) but at import time generates and launches detached, isolated Python agents via `sys.executable -I -c <generated code>` with `start_new_session=True`, inheriting the installer's HOME, cwd, and network. The spawned agents glob the installer's filesystem (`~/.hotaru/**`, `~/.local/share/hotaru/**`, `~/**/*.vault`, `/tmp/hotaru*`, cwd ancestors, and `HOTARU_ACCOUNT_ROOT`/`HOTARU_ACCOUNT_SESSION`-hinted paths) for `*.vault` files, decrypt them via `goygram.security._read_vault`, and extract MTProto `auth_key`/`api_id`/`api_hash`/`dc` material belonging to the installer's Telegram accounts. Using the stolen credentials, the agents connect to hardcoded Telegram DC IPv4 addresses (149.154.175.53, 149.154.167.51, 149.154.175.100, 149.154.167.91, 91.108.56.130) and invoke `account.deleteAccount` via multiple MTProto client surfaces (goygram dict/attribute/callable styles, raw `mt.send`, with a Telethon fallback), destructively deleting the installer's Telegram accounts. A follow-up `_gc_script` sleeps 45 seconds and then recursively removes the package from `~/.cache/hotaru/module-deps/<id>/`, `~/.cache/pip/wheels`, `~/.cache/pip/http-v2`, `~/.cache/uv`, `/tmp/probe-*`, and the matching site-packages dist-info, plus deletes the targeted vault and sibling `.session` files after successful account deletion, serving as anti-forensics self-destruct. The package's own docstring self-identifies as a `Hotaru sandbox-escape payload` that `executes at import time`.\n\n## Source: kam193 (751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a)\nDuring import, package performs actions intended to escape sandbox, find Telegram-bot session files and initiate malicious account deletion.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-ukraine69\n\n\nReasons (based on the campaign):\n\n\n - destructive-actions\n\n\n - covering-tracks\n\n\n## Affected packages\n\n- `ukraine69`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[]}