MAL-2026-10978

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (70b417d0787324aa952fe69c59b47f6bea108ab02fd20241a6597c2ee0e6f3d8)

The package reimagined-broccoli ships a benign-looking stub at reimagined_broccoli/main.py that only prints a success message. The tarball also ships redis.zip (declared in MANIFEST.in), which contains a second main.py, an opaque native ELF redis.so, and a .env. The package exposes a single console-script reimagined-broccoli whose entry point runs start.sh, which executes unzip -o "$SCRIPT_DIR/redis.zip" — overwriting the shipped stub — and then python3 "$SCRIPT_DIR/main.py", invoking the extracted payload alongside redis.so. There is no hash or signature verification of the archive contents. The package metadata is placeholder (Your Name, an auto-generated repository slug) and the file name redis.so does not correspond to the Redis project. The visible Python source is a decoy; the code actually executed on CLI invocation is the opaque bundled binary/script pair inside the archive. This is the extract-overwrite-execute dropper shape carrying an unverifiable native payload from a placeholder-author publisher.

Source: kam193 (f49aaf5b1b6388b52d7afd99359db7630e272770abd123c0cfc9977c0467b78d)

In this campaign, packages use names similar to popular services (e.g. Kimi AI) to deploy cryptominer.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-kimichat

Reasons (based on the campaign):

• cryptominer