sysdiagd

GHSA-64w9-pjq6-x8rh

Malicious code in sysdiagd (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.2.1`

## Source: kam193 (0d396ad34176d29956d695014d261847ada859c184d7a8e7820d96087af7eafe)
Disguised as a system monitoring tool, the package delivers a Discord bot acting as an infostealer exfiltrating credentials, browser data, files and recording audio, screenshots and video. The code requires providing bot credentials, it is not functional without providing them.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-10-sysdiagd


Reasons (based on the campaign):


 - rat


 - exfiltration-browser-data


 - persistence


 - exfiltration-credentials


 - files-exfiltration


 - spyware-like


 - infostealer

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/866a81f979da114949ac3b019f970e575be8e329/osv/malicious/pypi/sysdiagd/MAL-2026-17861.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/sysdiagd
- https://github.com/ossf/malicious-packages/blob/866a81f979da114949ac3b019f970e575be8e329/osv/malicious/pypi/sysdiagd/MAL-2026-17861.json
- https://github.com/advisories/GHSA-64w9-pjq6-x8rh

Compromised versions (1)

= 1.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.