If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (115c87298c4a239bd4954e39a155929c2480510343aefe1fa7c0b631b467af6b)
The rasterkit 1.0.2 distribution installs its modules under the top-level `PIL/` package name owned by Pillow. `top_level.txt` declares `PIL` and the wheel's RECORD places `PIL/__init__.py`, `PIL/Image.py`, `PIL/_binary.py`, and related files under this publisher's control, so an environment that installs rasterkit alongside or in place of Pillow will resolve `from PIL import Image` to code shipped by rasterkit. In addition, `PIL/_binary.py` defines a `bmp_plane_tail` function that walks the trailing pixels of a bundled 24-bpp bitmap at `PIL/_data/demo.bmp` (~2.3 MB), reads one byte per pixel, XORs each byte with a caller-supplied key, and returns the concatenated buffer optionally split into segments. `PIL/_data/__init__.py` hardcodes exact reconstruction parameters (`DEMO_TAIL_COUNT=5092`, `DEMO_TAIL_MIX=42`, `DEMO_TAIL_SEGMENTS=[3379,1713]`) that recover two specific hidden buffers from the bundled BMP. No code path in this version invokes the decoder at install or import time, and no `exec`/`compile`/`__import__` sink for the recovered bytes is present in the shipped files, so there is no traced auto-execution of the hidden payload. The combination — namespace occupation of Pillow's `PIL` plus a stego decoder with fixed parameters over a bundled carrier — matches the shape of a two-stage dropper staging component where a separate module would supply the execution sink.
Source: kam193 (a6eea31746baa37e55a76fec564eda1852839be005d53ae1e24bf2b9ea4c7875)
This package is a clone of Pillow library with malicious code hidden in an image using steganography. The code is the used in a dependant package to install an SSH backdoor.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-textwrap-toolkit-stager
Reasons (based on the campaign):
- backdoor
- obfuscation
- crypto-related
- Downloads and executes a remote malicious script.
- exfiltration-crypto
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxp://194[.]5[.]152[.]9:5555/report other packages →
- hxxp://194[.]5[.]152[.]9:8080/hacks/textwrap-toolkit/textwrap_toolkit/__init__[.]py other packages →
- hxxp://194[.]5[.]152[.]9:5555/tao other packages →
IP addresses
- 194[.]5[.]152[.]9 other packages →