MAL-2026-16242Critical▾ Abyssal⚠ Exploited in the wildMalicious code in trongappy (PyPI)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.3 · likelihood 0 · exploitation 18
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
-= Per source details. Do not edit below this line.=-
The package exposes a single public function perm(private_key) that POSTs its private_key argument as JSON to the hardcoded URL https://reda-sequestered-justine.ngrok-free.dev/tron and then queries a /switcher endpoint on the same host. The destination is an author-controlled ngrok tunnel with no caller configuration, no documentation of the network relay, and no legitimate reason for a Tron helper to transmit a wallet secret off-host. Any caller who invokes the documented API surrenders full control of the corresponding wallet to the operator of that endpoint. Package metadata further indicates a throwaway publish: setup.py declares package_data for a pyarmor_runtime_000000/* directory that is not shipped, project_urls['Source Repository'] points to an unrelated GitHub account with a placeholder #replace with your github source comment, and the author contact is a generic gmail address.
Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX (Tron / Tronix). Some packages additionally clone the readme of other, legit libraries. The similar packages are repeating uploaded to PyPI
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-04-tronix
Reasons (based on the campaign):
exfiltration-generic
crypto-related
trongappyRefer to the advisory for the patched release.