MAL-2026-10986

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (7ac2a6fc7368c6b3ed1bfac9a3a9ea25e9a54ba5d980a48767c811e03fc72566) The package presents itself as a local color-palette toolkit but exports a public `colors()` function in remote.py that POSTs to the hardcoded endpoint https://www.fastsyncapi.com/v1/colors, writes the returned bytes to a NamedTemporaryFile with a server-controlled filename/extension, and executes them without any hash or signature verification. On Windows the code silently installs.msi responses via `msiexec.exe /i /qn /norestart` and then launches a fixed binary path; on other platforms it invokes `os.startfile` / `xdg-open` / `open` on the dropped file. A companion `update()` function collects the installer's hostname, a SHA-256 HWID derived from hostname and MAC address (`uuid.getnode()`), and locale-derived country code and POSTs them along with a caller-supplied activation key to https://www.fastsyncapi.com/v1/update; the response token is persisted at `~/.config/npm-packages/vtoken.json` (Linux) or `%LOCALAPPDATA%/npm-packages/vtoken.json` (Windows) and reused by the dropper. All classes, functions, parameters, and locals across src/pycolored/* are renamed to random tokens (e.g. `_LBOfQSgdKR5ic9eT`, `_ji0wfcMCs1P5dOqg`), and the undocumented `colors` and `update` symbols are exported in `__all__` while the README only advertises a benign `colorsv1` helper. The `npm-packages` token directory inside a Python package indicates cross-registry actor infrastructure reuse.

## Source: kam193 (1aad1b8a73afbe28c708c4e19a1495793d1214980f72357a13d07b98f1f9a060) The package hides code to download and execute a remote executable from a newly created fastsyncapi[.]com domain. It is disguised as a remote 'fast color helper,' as opposed to the local helper, also included in the code, that only mimics any functionality. The malicious part is not immediately active: to download the binary, a key is required, which was not included in the analyzed versions. The downloaded binary is executed, and at least in one case disguised as 'AppHostRegistrationVerifier'. The package is likely prepared for multi-stage infection, but the trigger code using it was not identified.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-colorstack

Reasons (based on the campaign):

- Downloads and executes a remote executable.

- action-hidden-in-lib-usage