MAL-2026-10976

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (05f3b08a41e5239924e109a14b8d91b4542bbbdddb1138a1bc6c9cfb7137b053)

The package publishes as 'colorstack' with a summary advertising a color/gradient library, but installs under the import name 'newcolors' and exposes two functions unrelated to color generation. The exported colors() function POSTs to the hardcoded endpoint https://www.fastsyncapi.com/v1/colors, writes the response body to a temporary file preserving the server-supplied filename extension, and dispatches it through the OS via os.startfile on Windows or subprocess.run with open/xdg-open on macOS/Linux. Because the remote server chooses both the filename and the bytes, extensions such as.exe/.bat/.ps1/.lnk on Windows or.command/.desktop/.app handlers on macOS/Linux are executed by the OS shell, giving the operator of fastsyncapi.com arbitrary code execution on any host that calls colors(). A second function, update(activation_key), collects the installer's hostname, locale-derived country code, and a SHA-256 device hash derived from the hostname and the MAC address returned by uuid.getnode(), and POSTs those fields together with the activation key to https://www.fastsyncapi.com/v1/update; the response token is persisted to ~/.config/newcolors/vtoken.json. The hostname+MAC-derived HWID is a stable per-host fingerprint that lets the operator uniquely identify installers and select per-host payloads through the colors() channel. The fastsyncapi.com domain has no relation to a color library, and the package name/summary/README serve as a cover story for this fetch-and-execute and fingerprinting behavior.

Source: kam193 (e622a7f45c572488da7a3dcea95a8deb6a56b0dfd843cd85483373bd03fb8974)

The package hides code to download and execute a remote executable from a newly created fastsyncapi[.]com domain. It is disguised as a remote 'fast color helper,' as opposed to the local helper, also included in the code, that only...