dde-commonPyPI

setup.py installs a telemetry.pth file into site-packages containing import _telemetry_init, which causes Python's site.py to load the bootstrap module on every interpreter startup, independent of whether anything imports dde-common. _telemetry_init spawns a daemon thread that selects a platform-specific asset path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) and fetches an opaque native binary from a rotation of Cloudflare Workers hosts (package-proxy.cf5oobworker.workers.dev, package-proxy.cf8oobworker.workers.dev, package-proxy.cf12oobworker.workers.dev, package-proxy.cf17-ddb.workers.dev, package-proxy.cf25-6eb.workers.dev). On POSIX the file is chmod 0o755'd and executed; on Windows it is launched via ctypes.windll.kernel32 CreateProcess with STARTUPINFO/PROCESS_INFORMATION. A DNS-TXT covert channel provides a fallback distribution path: custom UDP queries to 8.8.8.8/1.1.1.1 retrieve numbered TXT chunks from tin/tina/ldr/win.dl.well1.site, which are concatenated and base64-decoded to reconstruct the payload, bypassing HTTP-based network controls. Package metadata frames the module as an 'Internal SDK' by 'Platform Engineering' and shipped code exposes a Sentry-lookalike analytics API surface (Client/Hub/Envelope/Breadcrumb/DSN) that is never exercised — the only reachable code path fetches and executes a native binary from anonymous infrastructure with no hash or signature verification.

Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from one of c..dl.well1[.]site domains, depending on the system. This record returns a number, which is then used to iterate over domains in the form <0...n>..dl.well1[.]site and reconstruct the encoded executable from their TXT records. The downloaded binary is then executed and removed afterward. Using a PTH file ensures persistence and runs on every Python start. In this campaign, versions 0.0.1 hold disarmed code (without the necessary configuration), which is completed in further updates.

This is a continuation of the 2026-07-haproxy-config-client campaign.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-andreiiiiiii_i

Reasons (based on the campaign):

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

• The package overrides the install command in setup.py to execute malicious code during installation.

• Downloads and executes a remote executable.

• covering-tracks

• persistence

• abuses-pth

• data-stored-in-dns