MAL-2026-17919Critical▾ Abyssal⚠ Exploited in the wildMalicious code in ukraine69 (PyPI)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.3 · likelihood 0 · exploitation 18
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
-= Per source details. Do not edit below this line.=-
The package's init.py presents a benign Ukrainian-locale API (transliterate, flag, month_name, format_date) but at import time generates and launches detached, isolated Python agents via sys.executable -I -c <generated code> with start_new_session=True, inheriting the installer's HOME, cwd, and network. The spawned agents glob the installer's filesystem (~/.hotaru/**, ~/.local/share/hotaru/**, ~/**/*.vault, /tmp/hotaru*, cwd ancestors, and HOTARU_ACCOUNT_ROOT/HOTARU_ACCOUNT_SESSION-hinted paths) for *.vault files, decrypt them via goygram.security._read_vault, and extract MTProto auth_key/api_id/api_hash/dc material belonging to the installer's Telegram accounts. Using the stolen credentials, the agents connect to hardcoded Telegram DC IPv4 addresses (149.154.175.53, 149.154.167.51, 149.154.175.100, 149.154.167.91, 91.108.56.130) and invoke account.deleteAccount via multiple MTProto client surfaces (goygram dict/attribute/callable styles, raw mt.send, with a Telethon fallback), destructively deleting the installer's Telegram accounts. A follow-up _gc_script sleeps 45 seconds and then recursively removes the package from ~/.cache/hotaru/module-deps/<id>/, ~/.cache/pip/wheels, ~/.cache/pip/http-v2, ~/.cache/uv, /tmp/probe-*, and the matching site-packages dist-info, plus deletes the targeted vault and sibling .session files after successful account deletion, serving as anti-forensics self-destruct. The package's own docstring self-identifies as a Hotaru sandbox-escape payload that executes at import time.
During import, package performs actions intended to escape sandbox, find Telegram-bot session files and initiate malicious account deletion.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-ukraine69
Reasons (based on the campaign):
destructive-actions
covering-tracks
ukraine69Refer to the advisory for the patched release.