🛡️ MAL-2026-10756 — darkglitch

Malicious code in darkglitch (PyPI)

Source: amazon-inspector

The package installs a listener CLI (darkglitch -l -b) that opens a WebSocket to the hardcoded signaling host malware-signal.vercel.app and joins the hardcoded room D4RKGLI7CH (core/data/client.py: HOST/ROOM constants). Incoming remote-command messages are executed on the host via subprocess.run(command, shell=True, capture_output=True,...) inside _process_command_request, with stdout/stderr returned to the sender. transfer_utils/transfer.py extends this channel with arbitrary file upload/download: build_transfer_command emits a python3 heredoc that base64-encodes any source path's bytes for exfiltration, and the upload branch base64-decodes attacker-supplied bytes to any target path. The README instructs users to build the listener as darkglitch_listener.exe with PyInstaller's --noconsole flag so no window appears, and internal modules (malware_signal, injection_utils, helper.py) describe themselves as a "post-exploitation framework" and "Advanced Command & Control Framework". The room identifier is shared, so any party who knows it can issue commands to any host running the listener.