sentinel-tool

Details

**Severity:** Critical

**Affected versions:** `= 0.1`

## Source: kam193 (5a2ff07802c4546c40d47d3780971506115297a1e8c177be36ad1e003dd62937)
The package installs a remote executable that uses a hardcoded Telegram channel for monitoring the user's activity, including regularly taking screenshots, and some remote control possibilities like switching the computer off and grabbing clipboard content. Some content suggests it was designed to be used by the uploader themself, but it poses the risk to anyone installing it.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-04-sentinel-tool


Reasons (based on the campaign):


 - Downloads and executes a remote executable.


 - spyware-like

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/sentinel-tool/MAL-2026-2516.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/sentinel-tool
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/sentinel-tool/MAL-2026-2516.json
- https://www.virustotal.com/gui/file/53b5e79fad807e269c8e7fdd924839e911ad58795d62dc09a4733833653b3569/detection
- https://github.com/advisories/GHSA-p6cx-82pc-56cj

Compromised versions (1)

• = 0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.