{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "colorstack"
      },
      "versions": [
        "0.1.0",
        "0.1.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)",
      "type": "REPORTER"
    }
  ],
  "database_specific": {
    "iocs": {
      "domains": [
        "fastsyncapi.com"
      ],
      "urls": [
        "https://www.fastsyncapi.com/v1/update",
        "https://www.fastsyncapi.com/v1/colors"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "pypi/2026-07-colorstack/colorstack",
        "import_time": "2026-07-21T09:20:45.738975863Z",
        "modified_time": "2026-07-21T08:05:18.916712Z",
        "sha256": "e622a7f45c572488da7a3dcea95a8deb6a56b0dfd843cd85483373bd03fb8974",
        "source": "kam193",
        "versions": [
          "0.1.0",
          "0.1.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (e622a7f45c572488da7a3dcea95a8deb6a56b0dfd843cd85483373bd03fb8974)\nThe package hides code to download and execute a remote executable from a newly created fastsyncapi[.]com domain. It is disguised as a remote \u0027fast color helper,\u0027 as opposed to the local helper, also included in the code, that only mimics any functionality. The malicious part is not immediately active: to download the binary, a key is required, which was not included in the analyzed versions. The downloaded binary is executed, and at least in one case disguised as \u0027AppHostRegistrationVerifier\u0027. The package is likely prepared for multi-stage infection, but the trigger code using it was not identified.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-07-colorstack\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - action-hidden-in-lib-usage\n",
  "id": "MAL-2026-10976",
  "modified": "2026-07-21T08:05:18Z",
  "published": "2026-07-21T08:05:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/colorstack"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in colorstack (PyPI)"
}