--- id: MAL-2026-17919 title: Malicious code in ukraine69 (PyPI) summary: Malicious code in ukraine69 (PyPI) severity: critical exploited: true vendor: ukraine69 product: ukraine69 ecosystem: pip affected: - ukraine69 published: '2026-10-17' updated: '2026-10-18' sourceUpdated: '2026-10-18T02:00:13.219086812Z' source: OSV sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-17919' references: - url: 'https://bad-packages.kam193.eu/pypi/package/ukraine69' - url: 'https://pypi.org/project/ukraine69/1.2.1/' - url: 'https://pypi.org/project/ukraine69/1.2.6/' - url: 'https://pypi.org/project/ukraine69/1.2.0/' - url: 'https://pypi.org/project/ukraine69/1.2.2/' - url: 'https://pypi.org/project/ukraine69/1.2.8/' - url: 'https://pypi.org/project/ukraine69/1.2.7/' - url: 'https://pypi.org/project/ukraine69/1.2.5/' tags: - osv - pip - malware ingestedAt: '2026-10-18T11:51:09.854Z' --- ## Overview --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4b8244951c9ae4f7baac94c3e7fd803e3c3ceaa27d64c2561cce098bd9dddf77) The package's __init__.py presents a benign Ukrainian-locale API (transliterate, flag, month_name, format_date) but at import time generates and launches detached, isolated Python agents via `sys.executable -I -c ` with `start_new_session=True`, inheriting the installer's HOME, cwd, and network. The spawned agents glob the installer's filesystem (`~/.hotaru/**`, `~/.local/share/hotaru/**`, `~/**/*.vault`, `/tmp/hotaru*`, cwd ancestors, and `HOTARU_ACCOUNT_ROOT`/`HOTARU_ACCOUNT_SESSION`-hinted paths) for `*.vault` files, decrypt them via `goygram.security._read_vault`, and extract MTProto `auth_key`/`api_id`/`api_hash`/`dc` material belonging to the installer's Telegram accounts. Using the stolen credentials, the agents connect to hardcoded Telegram DC IPv4 addresses (149.154.175.53, 149.154.167.51, 149.154.175.100, 149.154.167.91, 91.108.56.130) and invoke `account.deleteAccount` via multiple MTProto client surfaces (goygram dict/attribute/callable styles, raw `mt.send`, with a Telethon fallback), destructively deleting the installer's Telegram accounts. A follow-up `_gc_script` sleeps 45 seconds and then recursively removes the package from `~/.cache/hotaru/module-deps//`, `~/.cache/pip/wheels`, `~/.cache/pip/http-v2`, `~/.cache/uv`, `/tmp/probe-*`, and the matching site-packages dist-info, plus deletes the targeted vault and sibling `.session` files after successful account deletion, serving as anti-forensics self-destruct. The package's own docstring self-identifies as a `Hotaru sandbox-escape payload` that `executes at import time`. ## Source: kam193 (751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a) During import, package performs actions intended to escape sandbox, find Telegram-bot session files and initiate malicious account deletion. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-ukraine69 Reasons (based on the campaign): - destructive-actions - covering-tracks ## Affected packages - `ukraine69` ## Remediation Refer to the advisory for the patched release.