xxx-bale

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: kam193 (1109b5dc74c94551027044e54e20f9c1c18f89d53da6af87861ba4773eae1966)
The package contains code to install remotely stored malware and ensure its persistence. The code is not triggered automatically; it requires a separate trigger.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2025-07-cas-base


Reasons (based on the campaign):


 - Downloads and executes a remote executable.


 - malware


 - persistence

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/xxx-bale/MAL-2026-3428.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/xxx-bale
- https://github.com/kamakshyatest4/python-malware/blob/45f86d614fd5c8c01d844a458d56c292c7c060c2/requirements.txt#L1
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/xxx-bale/MAL-2026-3428.json
- https://tria.ge/250712-jwamlsyxat
- https://www.virustotal.com/gui/file/0338390d7b545f2695622df543b67b9a87131416b71dfb368a874a335a55238f/detection
- https://www.virustotal.com/gui/file/20377b8ee72f1371ed41228f47d4bce20b1b3c89b8465626fb78bc3f18ea935e/detection
- https://www.virustotal.com/gui/file/40b64916c5a38fde2b9939c674a2eaefd39df6216014e35a86b596746d34e2e9
- https://www.virustotal.com/gui/file/94b4fd98f0f168d999753bed16817ba15b0f17e7373819e3c383feac9dac58c1/detection

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.