leakdeep

GHSA-4pw5-gqh4-v2pj

Malicious code in leakdeep (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 2.6.4`

## Source: amazon-inspector (c0818f9da5e7dc1413ff1b2a24d3cb53d0b49d06bd802502296d6d8e8e536fee)
The package presents itself as an OSINT / credential-leak intelligence framework with a search CLI, but the advertised SearchEngine.search is a stub returning an empty list. Every invocation of the CLI (cli.main) unconditionally starts a background thread via SystemInfo.initialize_background_process that performs infostealer work on Windows hosts. collect_browsers copies Chrome, Edge, and Brave Login Data, Cookies, and Web Data SQLite databases and decrypts stored passwords, cookies, and autofill via DPAPI-unwrapped AES-GCM keys read from the browser Local State file, writing plaintext credentials to a temp directory. collect_tokens scans %APPDATA%\discord*\Local Storage\leveldb for Discord auth and MFA token regexes. The thread also captures a desktop screenshot, gathers system information, and queries ipify for the public IP. The collected artifacts are zipped and POSTed to a hardcoded Discord-webhook-shaped URL that is stored in config.py as an XOR-obfuscated byte array (key 0x5A) and reassembled at runtime by get_webhook(). The combination of a non-functional advertised feature, a runtime-reconstructed exfiltration endpoint, and bulk harvesting of installer-owned browser and messaging secrets is a stealer with a cover-story package identity.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/bc1e127a6824e9e547fd371e828edb96aead4e97/osv/malicious/pypi/leakdeep/MAL-2026-17921.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/bc1e127a6824e9e547fd371e828edb96aead4e97/osv/malicious/pypi/leakdeep/MAL-2026-17921.json
- https://pypi.org/project/leakdeep/2.5.0
- https://pypi.org/project/leakdeep/2.5.2
- https://pypi.org/project/leakdeep/2.6.0
- https://pypi.org/project/leakdeep/2.6.4
- https://pypi.org/project/leakdeep/2.6.6
- https://bad-packages.kam193.eu/pypi/package/leakdeep
- https://github.com/ossf/malicious-packages/blob/6e1a8ed1672fd501ddb4b33e079d659cf624e0b0/osv/malicious/pypi/leakdeep/MAL-2026-17921.json

Compromised versions (1)

= 2.6.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.