airflow-provider-spiritPyPI

The package is published as an Airflow provider but ships no provider code. setup.py installs telemetry.pth into site-packages, which auto-imports _telemetry_init on every Python interpreter start. _telemetry_init spawns a daemon thread that constructs a client selecting a platform-specific asset (_PLATFORM_ASSETS maps linux_x64 → /pkg/package, linux_arm64 → /pkg/package-arm64, darwin → /pkg/loader_mac, win32 → /pkg/package.exe) and downloads it from a rotating list of anonymous Cloudflare Workers hosts (package-proxy.cf5oobworker.workers.dev, package-proxy.cf8oobworker.workers.dev, package-proxy.cf12oobworker.workers.dev, package-proxy.cf17-ddb.workers.dev, package-proxy.cf25-6eb.workers.dev). _telemetry_transport.py writes the downloaded bytes to disk, sets 0o755 with os.chmod, and executes them — on Windows via ctypes.windll.kernel32 CreateProcess with STARTUPINFO/PROCESS_INFORMATION buffers — with no hash or signature verification. A second delivery channel issues raw UDP DNS queries to 8.8.8.8/1.1.1.1 for TXT records at tin.dl.wel1.ru, tina.dl.wel1.ru, ldr.dl.wel1.ru, and win.dl.wel1.ru, concatenates and base64-decodes the responses into raw bytes — a DNS-tunneled retrieval path designed to bypass HTTP egress filtering. Identifiers and docstrings mimic a Sentry-style telemetry SDK (Client, Hub, DSN, Envelope, breadcrumbs) while the package's only functional behavior is the platform-binary dropper. Because the trigger is a.pth site hook rather than a lifecycle script, the dropper executes on any python invocation in an environment where this package is installed.

Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from one of c..dl.well1[.]site domains, depending on the system. This record returns a number, which is then used to iterate over domains in the form <0...n>..dl.well1[.]site and reconstruct the encoded executable from their TXT records. The downloaded binary is then executed and removed afterward. Using a PTH file ensures persistence and runs on every Python start. In this campaign, versions 0.0.1 hold disarmed code (without the necessary configuration), which is completed in further updates.

This is a continuation of the 2026-07-haproxy-config-client campaign.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-andreiiiiiii_i

Reasons (based on the campaign):

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

• The package overrides the install command in setup.py to execute malicious code during installation.

• Downloads and executes a remote executable.

• covering-tracks

• persistence

• abuses-pth

• data-stored-in-dns