{"id":"MAL-2026-18219","aliases":[],"title":"Malicious code in onsokets (PyPI)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (86e89c263593521f9795193907958f4c642d34253fe9a65526dea1c681808760)\nonsokets/run.py walks the Android primary storage path /storage/emulated/0/, collects files ending in.json,.py,.pyrubi, and.txt, zips them by extension, and POSTs each archive to https://tapi.bale.ai/bot<token>/sendDocument with chat_id 5263487757. The Bale bot token is hardcoded in the source as the default for BALE_BOT_TOKEN, so installing or running this package exfiltrates installer-owned source, configuration, and text files to an author-controlled Bale chat. The destination is not caller-configurable in any meaningful sense and does not relate to any declared purpose of the package.\n\n## Source: kam193 (844774819aa502a53d6d364b6636fa62eb412fe8b30973c226aeb9b7b89865f9)\nThe package contains code for automated files exfiltration.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-proxyrubika\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - target:android\n","severity":"unknown","score":null,"published":"2026-10-23T12:42:59.000Z","modified":"2026-10-26T19:00:41.048Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"PyPI","name":"onsokets","ranges":[],"versions":["0.1.0"],"fixed":[]}],"references":["https://bad-packages.kam193.eu/pypi/package/onsokets","https://pypi.org/project/onsokets/0.1.0/"],"sources":[{"name":"OSV","id":"MAL-2026-18219","modified":"2026-10-26T19:00:41.048738849Z","url":"https://osv.dev/vulnerability/MAL-2026-18219"}],"assessments":[]}