ukraine69

GHSA-j83x-9pxh-rrgp

Malicious code in ukraine69 (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.2.0`

## Source: kam193 (751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a)
During import, package performs actions intended to escape sandbox, find Telegram-bot session files and initiate malicious account deletion.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-10-ukraine69


Reasons (based on the campaign):


 - destructive-actions


 - covering-tracks

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b815164fa3a6902f736245dea9a7ceaed19d225f/osv/malicious/pypi/ukraine69/MAL-2026-17919.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/ukraine69
- https://github.com/ossf/malicious-packages/blob/b815164fa3a6902f736245dea9a7ceaed19d225f/osv/malicious/pypi/ukraine69/MAL-2026-17919.json
- https://github.com/ossf/malicious-packages/blob/bc1e127a6824e9e547fd371e828edb96aead4e97/osv/malicious/pypi/ukraine69/MAL-2026-17919.json
- https://pypi.org/project/ukraine69/1.2.0
- https://pypi.org/project/ukraine69/1.2.1
- https://pypi.org/project/ukraine69/1.2.2
- https://pypi.org/project/ukraine69/1.2.5
- https://pypi.org/project/ukraine69/1.2.6

Compromised versions (1)

= 1.2.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.