{"id":"MAL-2026-17919","title":"Malicious code in ukraine69 (PyPI)","summary":"Malicious code in ukraine69 (PyPI)","severity":"critical","exploited":true,"vendor":"ukraine69","product":"ukraine69","ecosystem":"pip","affected":["ukraine69"],"published":"2026-10-17","updated":"2026-10-26","sourceUpdated":"2026-10-26T06:45:16.054574101Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17919","references":[{"url":"https://bad-packages.kam193.eu/pypi/package/ukraine69"},{"url":"https://pypi.org/project/ukraine69/1.2.1/"},{"url":"https://pypi.org/project/ukraine69/1.2.6/"},{"url":"https://pypi.org/project/ukraine69/1.2.0/"},{"url":"https://pypi.org/project/ukraine69/1.2.2/"},{"url":"https://pypi.org/project/ukraine69/1.2.8/"},{"url":"https://pypi.org/project/ukraine69/1.2.7/"},{"url":"https://pypi.org/project/ukraine69/1.2.5/"},{"url":"https://inspector.pypi.io/project/ukraine69/1.2.0/packages/2c/3f/e51de071990c6e81c9f9d59b7adde323fd0dacd0e52961513ccae945aeb6/ukraine69-1.2.0-py3-none-any.whl/ukraine69/__init__.py#line.208"},{"url":"https://inspector.pypi.io/project/ukraine69/1.2.1/packages/94/92/3895a2d5a934ea9f9c05d9f316d7bca905eb3fac863fdf3051aa14e4277b/ukraine69-1.2.1-py3-none-any.whl/ukraine69/__init__.py#line.208"},{"url":"https://inspector.pypi.io/project/ukraine69/1.2.2/packages/45/be/70b11f7a1065b918fff7e273a8929cfec6117ba10f6da1b9651d6fc6b0a9/ukraine69-1.2.2-py3-none-any.whl/ukraine69/__init__.py#line.221"},{"url":"https://inspector.pypi.io/project/ukraine69/1.2.3/packages/69/a0/b71eda561d5b482f528b562285e74dbdbc74a4879d1b328f3c5712f42621/ukraine69-1.2.3-py3-none-any.whl/ukraine69/__init__.py#line.120"},{"url":"https://inspector.pypi.io/project/ukraine69/1.2.5/packages/98/2a/40f168e0a9989e6c72650df04f7ec3cc0b4e11481b5d987c7c6990d294b2/ukraine69-1.2.5-py3-none-any.whl/ukraine69/__init__.py#line.321"},{"url":"https://inspector.pypi.io/project/ukraine69/1.2.6/packages/40/65/cf3c297418f42056da1aa1ac74dee1a2ada2bc9e7048701429acd6fb17f2/ukraine69-1.2.6-py3-none-any.whl/ukraine69/__init__.py#line.354"},{"url":"https://inspector.pypi.io/project/ukraine69/1.2.7/packages/1e/b8/421ab6c05f83983a337619596ad8e40126aa6319afdc91d73865da43ff8e/ukraine69-1.2.7-py3-none-any.whl/ukraine69/__init__.py#line.406"},{"url":"https://inspector.pypi.io/project/ukraine69/1.2.8/packages/64/23/da183671983a86a4c92daffd479996dc61e50c93ac6f73d62083294dec4d/ukraine69-1.2.8-py3-none-any.whl/ukraine69/__init__.py#line.861"},{"url":"https://pypi.org/project/ukraine69/1.2.3/"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-10-18T11:51:09.854Z","slug":"MAL-2026-17919","body":"## Overview\n\nImporting `ukraine69` in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local `.vault` files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts `account.deleteAccount` using GoyGram, with a Telethon fallback in versions 1.2.5–1.2.8. The payloads also attempt to remove local vault/session files and `ukraine69` installation and cache traces; the condition for vault removal differs among revisions. Versions 1.2.5–1.2.8 specifically target Hotaru session vault layouts, and 1.2.7–1.2.8 additionally try `auth.checkPassword` if a password is present in the vault. Version 1.2.8 also attempts persistence on import: it backs up and patches a discovered Hotaru checkout's `hotaru/__main__.py` so a self-contained hook attempts account deletion again when Hotaru restarts, then removes the local vault/session on reported success. Version 1.2.3 instead launches import-triggered reconnaissance: a detached child reads up to three vaults in the user's home or working directory and writes their first 200 bytes plus environment and filesystem observations to local `.u69_recon.log` files. No external exfiltration or account-deletion call appears in 1.2.3. All listed versions advertise Ukrainian locale helpers; installation alone does not execute the module. Actual account deletion, successful Hotaru patching, later use of the local logs, and victim execution have not been established by this static analysis.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4b8244951c9ae4f7baac94c3e7fd803e3c3ceaa27d64c2561cce098bd9dddf77)\nThe package's __init__.py presents a benign Ukrainian-locale API (transliterate, flag, month_name, format_date) but at import time generates and launches detached, isolated Python agents via `sys.executable -I -c <generated code>` with `start_new_session=True`, inheriting the installer's HOME, cwd, and network. The spawned agents glob the installer's filesystem (`~/.hotaru/**`, `~/.local/share/hotaru/**`, `~/**/*.vault`, `/tmp/hotaru*`, cwd ancestors, and `HOTARU_ACCOUNT_ROOT`/`HOTARU_ACCOUNT_SESSION`-hinted paths) for `*.vault` files, decrypt them via `goygram.security._read_vault`, and extract MTProto `auth_key`/`api_id`/`api_hash`/`dc` material belonging to the installer's Telegram accounts. Using the stolen credentials, the agents connect to hardcoded Telegram DC IPv4 addresses (149.154.175.53, 149.154.167.51, 149.154.175.100, 149.154.167.91, 91.108.56.130) and invoke `account.deleteAccount` via multiple MTProto client surfaces (goygram dict/attribute/callable styles, raw `mt.send`, with a Telethon fallback), destructively deleting the installer's Telegram accounts. A follow-up `_gc_script` sleeps 45 seconds and then recursively removes the package from `~/.cache/hotaru/module-deps/<id>/`, `~/.cache/pip/wheels`, `~/.cache/pip/http-v2`, `~/.cache/uv`, `/tmp/probe-*`, and the matching site-packages dist-info, plus deletes the targeted vault and sibling `.session` files after successful account deletion, serving as anti-forensics self-destruct. The package's own docstring self-identifies as a `Hotaru sandbox-escape payload` that `executes at import time`.\n\n## Source: kam193 (751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a)\nDuring import, package performs actions intended to escape sandbox, find Telegram-bot session files and initiate malicious account deletion.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-ukraine69\n\n\nReasons (based on the campaign):\n\n\n - destructive-actions\n\n\n - covering-tracks\n\n\n## Affected packages\n\n- `ukraine69`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[]}