---
id: MAL-2026-10755
title: Malicious code in captcha-solve-api (PyPI)
summary: Malicious code in captcha-solve-api (PyPI)
severity: none
vendor: captcha-solve-api
product: captcha-solve-api
ecosystem: pip
affected:
  - captcha-solve-api
published: '2026-07-16'
updated: '2026-07-16'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-10755'
references:
  - url: 'https://pypi.org/project/captcha-solve-api/0.0.1/'
tags:
  - osv
  - pip
ingestedAt: '2026-07-17T13:07:04.263Z'
---

## Overview


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ee854f4888e58f81b9e22e7addd740d28a717be453133c10267dd91fc5e50cee)
The package advertises itself as a REST client for a captcha-solving API, but the shipped captcha_solve_api module is a ~20-line stub. The tarball's real payload is two top-level modules (_telemetry_init, _telemetry_transport, ~117 KB) installed as global site modules together with a telemetry.pth file copied into site-packages by a custom install command. The.pth contains `import _telemetry_init`, which Python auto-executes on every interpreter start — independent of whether captcha_solve_api is ever imported. _telemetry_init spawns a daemon thread that instantiates _telemetry_transport.Client and calls initialize()/track(). The runtime collects host identifiers (platform.node() hostname, cpu_count, OS/arch, Python version, session identifiers) and POSTs JSON envelopes to /api/envelope on a destination host that is not hardcoded: a ServiceDiscovery class issues DNS TXT queries to 8.8.8.8 and 1.1.1.1 and base64-decodes concatenated TXT chunks to reconstruct the endpoint, allowing the operator to rotate destinations after install and evade domain/IP allowlists. Author metadata is a generic placeholder ('Platform Engineering') and the DSN docstring uses dev@example.com. The 'telemetry'/'analytics SDK' framing does not match the advertised captcha-solving purpose and is not part of the captcha_solve_api namespace.


## Affected packages

- `captcha-solve-api`

## Remediation

Refer to the advisory for the patched release.