saeka

GHSA-mg63-mhjw-2w9m

Malicious code in saeka (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: kam193 (67507c9821e48c6f8284a142ae4788a9624ea608f782bf254573dae4936e7a04)
The package is a mass credit card checker: it checks if credit card data are real and active by abusing real online retail services.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-10-saeka


Reasons (based on the campaign):


 - abusing-3rd-api

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/7af44fdfc9653a62c179e1c9a6247dcbf4d1ccbd/osv/malicious/pypi/saeka/MAL-2026-17877.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/saeka
- https://github.com/ossf/malicious-packages/blob/7af44fdfc9653a62c179e1c9a6247dcbf4d1ccbd/osv/malicious/pypi/saeka/MAL-2026-17877.json
- https://files.pythonhosted.org/packages/1d/ac/bf3712526f199c2bea2dbbddbbfb5106270ff8a9d595fd22c5eee12d1734/saeka-8.0.tar.gz
- https://files.pythonhosted.org/packages/b6/a2/027a3e45840b578d632543c55abcb10deb5035e962a0c5ff07f3827180f0/saeka-15.0.tar.gz
- https://github.com/ossf/malicious-packages/blob/7edda414f639063073b498a267946f8086e35ecd/osv/malicious/pypi/saeka/MAL-2026-17877.json
- https://pypi.org/project/saeka
- https://github.com/advisories/GHSA-mg63-mhjw-2w9m

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.