If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (a904eba641878bae63f76595a468b0faaa66fd27104ac557249e457f005c3fb1)
The package installs a site-wide `cfgzen.pth` containing `import dotcfg`, which Python's site machinery executes automatically at every interpreter startup — turning every `python` invocation on the host into a trigger for the payload. On import, `dotcfg/__init__.py` spawns a detached background Python subprocess (env-gated with `_CFGZ_BG=1` and `CREATE_NO_WINDOW` on Windows) that re-imports the package and calls `_native.platform_check()` in the shipped Windows PyO3 extension `dotcfg/_native.pyd`. The native module contains: a hardcoded anonymous file-drop endpoint at `files.catbox.moe/7t4wyu.*`; WinHTTP and raw ws2_32 socket primitives with a spoofed Mozilla Windows User-Agent; enumeration of host identifiers (`COMPUTERNAME`, `HOSTNAME`, `USERNAME`, `USER`, `LOCALAPPDATA`, `TEMP`) staged into a file named `envcorecache.dat`; a CI/sandbox-evasion fingerprint enumerating 14+ build-environment variables (`GITHUB_ACTIONS`, `GITLAB_CI`, `JENKINS_HOME`, `TRAVIS`, `CIRCLECI`, `CODEBUILD_BUILD_ID`, `TF_BUILD`, `BUILDKITE`, `DRONE`, `APPVEYOR`, `CI`, `CONTINUOUS_INTEGRATION`, `TEAMCITY_VERSION`, `HEROKU_TEST_RUN_ID`); and Microsoft-mimicry staging paths (`Microsoft\EdgeUpdate\EdgeUpdateService.exe`, `Microsoft\WindowsApps\RuntimeBroker_v2.exe`, `Microsoft\Edge\Temp\msedge_installer.exe`, `Microsoft\MediaSync\MediaSyncAgent.exe`, `Microsoft\Provisioning\ProvisioningHost.exe`). The combination —.pth-based persistence, hidden detached subprocess, host fingerprinting, dual HTTP/socket exfil transports to an anonymous file host, CI-evasion, and Edge/Update-mimicry file names — is a Windows stealer/dropper, not a `.env` parser.
Source: kam193 (588fed6ec45af5cfb8925b1f7d93b07b73d47b919a50305438153dfbb7f953e1)
The malicious code sits in a native module, which is called in a few places, including the code run via PTH embedded since version 1.0.6. The native module downloads an encrypted blob and decrypt it to an executable being an infostealer.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-07-cfgzen
Reasons (based on the campaign):
- infostealer
- exfiltration-env-variables
- Downloads and executes a remote executable.
- obfuscation
- The package contains code to detect if it is running in a sandbox environment.
- exfiltration-crypto
- native-extension
- persistence
- abuses-pth
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://files[.]catbox[.]moe/7t4wyu[.]bin other packages →
- hxxp://89[.]124[.]86[.]198/ping other packages →
- hxxp://89[.]124[.]86[.]198/submit other packages →