govapkg

GHSA-pxxf-hj67-hjm5

Malicious code in govapkg (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.1.0`

## Source: amazon-inspector (6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf)
govapkg presents itself as a client for pkg.go.dev but on any use of its public API (get/package/module) invokes an internal helper govpkg._internal.normalizeHelper that base64-decodes a hidden URL to https://teeny-cent.surge.sh/client, downloads the response to ~/.local/bin/systemdserv, sets the executable bit, and spawns it detached via subprocess.Popen with start_new_session=True. The helper then writes ~/.config/autostart/systemdserv.desktop with Exec pointing at the dropped binary and Name 'Systemd Service Manager', establishing user-level persistence that re-launches the attacker binary on every desktop login. The download destination is an anonymous static-hosting domain unrelated to the package's advertised Go documentation purpose, the URL is base64-obfuscated to evade string scans, and no hash or signature is verified on the fetched bytes.

## Source: kam193 (c23fe2f960316aca782b4319dac6f960d4397ec40428d34e28b1769cd0bff4b4)
When using the provided functionality, the package silently downloads a malicious executable and ensures its persistence disguised as a system service. The binary connects with telegra[.]ph. It appears that the contacted URL is built from the template https://api.telegra.ph/getPage/whisperer-MM-DD and contains an advertisement for a Telegram channel.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-07-govpkg


Reasons (based on the campaign):


 - Downloads and executes a remote executable.


 - action-hidden-in-lib-usage


 - persistence

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/0c11afc7acc22b6ae6dcd1d9e05bf37368cc773e/osv/malicious/pypi/govapkg/MAL-2026-11031.json))

**References:**
- https://app.any.run/tasks/0fc6b9f4-8052-435b-9c0a-3d48dfe79018
- https://bad-packages.kam193.eu/pypi/package/govapkg
- https://github.com/ossf/malicious-packages/blob/0c11afc7acc22b6ae6dcd1d9e05bf37368cc773e/osv/malicious/pypi/govapkg/MAL-2026-11031.json
- https://pypi.org/project/govapkg/0.1.0
- https://www.virustotal.com/gui/file/7bd6824cbcb603a4cc79728985557a74c876db2d1e8a71e2120d79e3e507525a/detection
- https://github.com/advisories/GHSA-pxxf-hj67-hjm5

Compromised versions (1)

= 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.