ryry-cli

Details

**Severity:** Critical

**Affected versions:** `= 6.28`

## Source: amazon-inspector (4a305ba94c92b6ec62aaf627fc1213d9e37e1645f37fd033f61c7becaba71edd)
ryry-cli runs as a long-lived agent that connects to a hardcoded WebSocket at wss://api.dalipen.com/aigc/task/connect and executes Python scripts under subprocess.Popen based on task messages sent by that server. During its polling loop it calls aigc/task/getAutoDeployWidget and, for each entry the server returns, runs `pip install <server-supplied URL>` on arbitrary wheels or downloads a zip and installs its requirements.txt, giving the remote endpoint unattended code execution on the host. utils.check_restart() writes a shell script that runs `apt-get update && apt-get upgrade && apt-get install -y...` and `pip install -U ryry-cli` and schedules it via `at now + 1 minutes` or Windows schtasks, mutating system packages and self-upgrading the CLI outside the user's package manager. taskUtils posts JSON payloads containing socket.gethostname() and a MAC/CPU-serial-derived device id, plus task log files, to a hardcoded WeChat work webhook at qyapi.weixin.qq.com/cgi-bin/webhook/send with an embedded key. A server-supplied Mihomo/Clash subscription URL fetched from aigc/task/config is applied by proxy_manager to route the agent's outbound traffic through an author-controlled proxy configuration. The package also embeds base64-encoded Aliyun OSS access-key ID and secret (utils.K1/K2) that are decoded at runtime and used to PUT files to the author's p-template-hk / p-upload-gz buckets.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/ryry-cli/MAL-2026-10759.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/ryry-cli/MAL-2026-10759.json
- https://pypi.org/project/ryry-cli/6.26
- https://pypi.org/project/ryry-cli/6.28
- https://github.com/advisories/GHSA-3vrg-j834-vx23

Compromised versions (1)

• = 6.28

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.