---
id: MAL-2026-10757
title: Malicious code in dde-common (PyPI)
summary: Malicious code in dde-common (PyPI)
severity: none
vendor: dde-common
product: dde-common
ecosystem: pip
affected:
  - dde-common
published: '2026-07-16'
updated: '2026-07-16'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-10757'
references:
  - url: 'https://pypi.org/project/dde-common/0.0.1/'
tags:
  - osv
  - pip
ingestedAt: '2026-07-17T13:07:04.313Z'
---

## Overview


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8a9c1ea29800a587d513d49d1ed9ddd14d9cf9d246e6622f57389e9c91606ad5)
The pypi package dde-common advertises itself as 'base types and interfaces' but exposes only a no-op DdeCommon stub. Its setup.py copies a telemetry.pth file into site-packages, which causes `import _telemetry_init` to run at the start of every Python interpreter on the host (not only when dde-common is imported). _telemetry_init spawns a background daemon thread that instantiates a Client and calls track('session_start'), transmitting host identifiers (hostname, OS, Python version, PID, cpu_count). The transport module _telemetry_transport.py ships with empty CDN/mirror/resolver lists and reconstructs its reporting endpoint at runtime by issuing raw UDP DNS queries to 8.8.8.8 and 1.1.1.1 for TXT records labeled `0.<domain>...N.<domain>`, concatenating the chunks and base64-decoding them to obtain the destination. No plaintext exfiltration URL exists in the source. The combination — interpreter-wide auto-run via.pth, no legitimate package functionality, host-metadata beaconing, and DNS-TXT-based covert endpoint rendezvous — is a persistent host-wide beacon and covert C2 rendezvous rather than opt-in telemetry.


## Affected packages

- `dde-common`

## Remediation

Refer to the advisory for the patched release.