wacve-utils

Source: amazon-inspector (4b2e59800b6fa0d3429fb7bccd34b4ae292dc2668919fba704a7b16ddff71071)
On `import wacve_utils`, the package's `__init__.py` unconditionally invokes `check_for_updates()`, which HTTP-fetches a hardcoded GitHub Gist under the user `Darknet-Hacker` (gist.githubusercontent.com/Darknet-Hacker/7f7e01a86e68403a457c4cd0c2d93f1d/raw/), base64-decodes the body, XORs it with a key derived from the string `wacve_utils`, zlib-decompresses it, `marshal.loads` a Python code object, and `exec`s it in-process. If the Gist fetch fails, the module falls back to shipped opaque blobs `config-linux.dat` / `config-termux.dat` (selected by a Termux/Linux platform branch) and runs them through the same base64+XOR+zlib+marshal decode-and-exec path. No pinning, no signature verification, and the payload is mutable by the Gist owner. The package advertises itself as `Lightweight utilities for chat application security checks` and exposes a stub `check_vulnerability` that returns a random boolean — a cover story unrelated to the executed payload. Importing this package grants the Gist owner arbitrary code execution in the installer's Python process.

Source: kam193 (de96a68d25555c9ee1792a22b84307ba3bc68d1e012bd841454dc775986260cb)
The package contains encrypted code with infostealers targeting Linux and Android (execution under Termux). The encrypted code collects files, browsers data, text messages and exfiltrates them to a Telegram channel.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-wacve-utils

Reasons (based on the campaign):

- files-exfiltration

- exfiltration-browser-data

- uses-telegram-bot

- obfuscation

- Downloads and executes a remote malicious script.

- infostealer