MAL-2026-10978

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (70b417d0787324aa952fe69c59b47f6bea108ab02fd20241a6597c2ee0e6f3d8) The package `reimagined-broccoli` ships a benign-looking stub at `reimagined_broccoli/main.py` that only prints a success message. The tarball also ships `redis.zip` (declared in MANIFEST.in), which contains a second `main.py`, an opaque native ELF `redis.so`, and a `.env`. The package exposes a single console-script `reimagined-broccoli` whose entry point runs `start.sh`, which executes `unzip -o "$SCRIPT_DIR/redis.zip"` — overwriting the shipped stub — and then `python3 "$SCRIPT_DIR/main.py"`, invoking the extracted payload alongside `redis.so`. There is no hash or signature verification of the archive contents. The package metadata is placeholder (`Your Name`, an auto-generated repository slug) and the file name `redis.so` does not correspond to the Redis project. The visible Python source is a decoy; the code actually executed on CLI invocation is the opaque bundled binary/script pair inside the archive. This is the extract-overwrite-execute dropper shape carrying an unverifiable native payload from a placeholder-author publisher.

## Source: kam193 (f49aaf5b1b6388b52d7afd99359db7630e272770abd123c0cfc9977c0467b78d) In this campaign, packages use names similar to popular services (e.g. Kimi AI) to deploy cryptominer.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-kimichat

Reasons (based on the campaign):

- cryptominer