Malicious code in onsokets (PyPI)
The advisory, in context
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (86e89c263593521f9795193907958f4c642d34253fe9a65526dea1c681808760)
onsokets/run.py walks the Android primary storage path /storage/emulated/0/, collects files ending in.json,.py,.pyrubi, and.txt, zips them by extension, and POSTs each archive to https://tapi.bale.ai/bot<token>/sendDocument with chat_id 5263487757. The Bale bot token is hardcoded in the source as the default for BALE_BOT_TOKEN, so installing or running this package exfiltrates installer-owned source, configuration, and text files to an author-controlled Bale chat. The destination is not caller-configurable in any meaningful sense and does not relate to any declared purpose of the package.
Source: kam193 (844774819aa502a53d6d364b6636fa62eb412fe8b30973c226aeb9b7b89865f9)
The package contains code for automated files exfiltration.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-proxyrubika
Reasons (based on the campaign):
-
files-exfiltration
-
target:android
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
1 explicitly affected versions
0.1.0
View affected-version evidence
{
"ranges": [],
"versions": [
"0.1.0"
]
}