GitHub Advisory PyPI CWE-506 sweep - 3-package 2026-08-06 batch (`xAyOuB-XcTxTeaM` Garena Free Fire spam-cannon botnet + `uncrypt` browser infostealer + `decapod-common` pentest)

What happened

On 2026-08-06, the GitHub Advisory Database published 3 new PyPI CWE-506 (Embedded Malicious Code) advisories across three unrelated clusters. The most novel is xAyOuB-XcTxTeaM, which is not a credential stealer at all but a Garena Free Fire spam-cannon botnet that turns the install host into a relay node.

Cluster A - xAyOuB-XcTxTeaM Garena Free Fire spam-cannon botnet (1 package, 2026-08-06)

| Package | Versions | Notes | |---|---|---| | xAyOuB-XcTxTeaM | 0.1.0, 0.1.1, 0.1.2 | Flask server on 0.0.0.0:50019, ~20 hardcoded Garena Free Fire accounts, invite-spam relay using installer IP |

Behaviour chain per GHSA-3q6h-q26c-838m:

1. Import-time trigger: on import xAyOuB_XcTxTeaM the package launches a Flask HTTP server bound to 0.0.0.0:50019 (all interfaces, on a port unlikely to conflict with common services).
2. HTTP surface: exposes three endpoints - /spam?uid=<victim_uid>, /stop, /status - accessible to any network peer that can reach the host on port 50019.
3. Credential bundle: ships ~20 hardcoded Garena Free Fire account credentials + OAuth secrets in plaintext inside the package tarball. Background threads authenticate all 20 accounts on startup.
4. Spam abuse: on hit of /spam?uid=<victim_uid> the server sends invite-spam packets to the target Garena UID using the ~20 pre-auth'd accounts. All traffic originates from the installer's public IP - the operator uses installed instances as a distributed pool of source IPs to defeat rate limiting.
5. TLS disabled: explicit verify=False on HTTPS calls - matches the profile of quickly-thrown-together spam tooling more than a stealth infostealer.

This is a distinctively different threat profile from the standard CWE-506 credential stealer - the payload does not steal from the installer host at all. Instead the installer host is weaponised as a spam-relay node for gaming-platform abuse, exposing its public IP to Garena's abuse-reporting infrastructure and any downstream legal or reputational consequences of being named as a Garena Free Fire spam source.

Cluster B - uncrypt browser-data infostealer with embedded executable (1 package, 2026-08-06)

| Package | Versions | Campaign | Notes | |---|---|---|---| | uncrypt | 0.1.0, 0.1.1, 0.1.2 | 2026-08-uncrypt | Embedded executable, browser-data harvest, sandbox detection |

Per GHSA-qx28-hgj2-5h9g, the package silently starts an embedded executable on import - no user disclosure. The executable:

1. Detects sandbox environments (and presumably no-ops in them to evade dynamic analysis).
2. Harvests browser data (login credentials, cookies, extension local storage).
3. Communicates with an external attacker-controlled domain to exfiltrate the collected data.
4. Exfiltrates basic host information (IP + username) as fingerprinting metadata.

Embedded-executable delivery is a mid-sophistication technique - the malicious logic lives in a compiled binary shipped inside the tarball rather than in the setup.py or module Python source, defeating naive source-code static analysis but adding install-footprint. Attributed to campaign 2026-08-uncrypt.

Cluster C - pentest / low-harm host-recon (1 package, 2026-08-06)

| Package | Versions | Campaign | Notes | |---|---|---|---| | decapod-common | 0.0.0, 1.2.dev1, 1.2.dev2 | GENERIC-standard-pypi-install-pentest (classified PROBABLY_PENTEST) | IP + username exfil only, "no other purpose" |

Standard pentest-recon payload matching the launchdarkly-ai-server-sdk pattern from the 2026-08-04 batch - IP + username exfil during install, nothing else. Advisory expressly notes limited harm potential. Version choice (0.0.0 + two 1.2.dev* variants) suggests the operator squatted an internal-tooling-style name (decapod-common reads as a real internal-utility package) and used both a placeholder 0.0.0 and dev-release versions to probe different dep-confusion resolution paths.

Registry state

All 3 packages yanked from PyPI during the 2026-08-06 takedown. Original tarballs no longer resolvable on the public index, but private mirrors (devpi, Artifactory, Nexus, AWS CodeArtifact, Google Artifact Registry) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

Related tracked activity

• The 2026-08-uncrypt campaign name is currently a single-package designation - watch subsequent daily PyPI GHSA batches for related uncrypt-* / encrypt-* / decrypt-* variants.
• The GENERIC-standard-pypi-install-pentest classification recurs across the last several daily sweeps (see pypi-2026-08-04-ghsa-malware-sweep Cluster B, pypi-2026-07-31-ghsa-malware-sweep) - probably the same red-team tester continuing systematic PyPI dep-confusion mapping.
• The xAyOuB-XcTxTeaM gaming-abuse profile is distinct from most PyPI CWE-506 drops - closer to prior Discord / Roblox / Fortnite token-stealer patterns but repurposed as an active spam-relay rather than a credential harvester. No sibling advisories under a matching campaign name yet, but the name shape (xAyOuB-XcTxTeaM reads as a gaming-scene handle) suggests the operator is a script-kid-tier gaming actor rather than a professional supply-chain crew.
• No threatActor field is set - the OpenSSF campaign names are campaign designations, not named actors.

Affected packages (3)

Impact

• Cluster A - xAyOuB-XcTxTeaM Garena Free Fire spam-cannon botnet (1 package, 0.1.0..0.1.2, 2026-08-06): on import the package launches a Flask server on 0.0.0.0:50019 and exposes /spam?uid=, /stop, /status HTTP endpoints. Background threads authenticate ~20 hardcoded Garena Free Fire accounts (credentials + OAuth secrets shipped in plaintext) and send invite-spam packets to attacker-specified UIDs using the installer's IP address as source. TLS verification is explicitly disabled. Any host that imported this package became a spam-relay node for gaming-platform abuse
• Cluster B - uncrypt browser-data infostealer (1 package, 0.1.0..0.1.2, 2026-08-06): on import, "silently starts an embedded executable" that harvests browser data and beacons to an external domain. Sandbox detection is present, then exfiltrates basic host information (IP + username) to the C2. Attributed to campaign 2026-08-uncrypt
• Cluster C - pentest / low-harm host-recon (1 package, 0.0.0+1.2.dev1+1.2.dev2, 2026-08-06): decapod-common classified PROBABLY_PENTEST under GENERIC-standard-pypi-install-pentest - exfiltrates only host IP + username, "no other purpose"
• Every host that installed xAyOuB-XcTxTeaM should be treated as potentially exposed to reputational and legal risk - the install-machine's public IP was used to spam Garena Free Fire users. Confirm whether Garena account-abuse reports name the host's IP
• All 3 packages yanked from PyPI during the 2026-08-06 takedown. Private mirrors that cached tarballs BEFORE the takedown WILL keep serving the original versions

What to do

1. 1Grep every lockfile (requirements.txt, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda-lock.yml) for xAyOuB-XcTxTeaM, uncrypt, decapod-common. Any match on xAyOuB-XcTxTeaM is a spam-relay incident - the host was used to abuse the Garena Free Fire platform from its own public IP
2. 2For xAyOuB-XcTxTeaM matches: check outbound firewall + host network state for a listening socket on 0.0.0.0:50019 (may still be alive if the process was left running). Kill the process, block the port at the host firewall, and audit any external HTTP connections to the exposed Flask endpoints made in the exposure window - the operator will have hit /spam?uid= from an external IP to drive the botnet
3. 3For uncrypt matches: treat the host as browser-data-compromised. Rotate every browser-saved password, revoke every stored session cookie (log out of all sessions on every site), and consider re-imaging
4. 4Audit outbound network from the affected host for the xAyOuB-XcTxTeaM C2 endpoints (Garena Free Fire authentication + invite APIs), the uncrypt C2 domain, and generic-pentest beacon patterns
5. 5For all PyPI installs in CI, prefer pip install --require-hashes with a fully-hashed requirements.txt or Poetry / uv / pdm lockfiles that pin resolved hashes
6. 6Verify none of the 3 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

• GHSA-3q6h-q26c-838m - xAyOuB-XcTxTeaM malware advisory (Garena Free Fire spam-cannon Flask server)

  github.com
  GitHub
• GHSA-qx28-hgj2-5h9g - uncrypt malware advisory (embedded-executable browser infostealer)

  github.com
  GitHub
• GHSA-vxw2-2m2p-c6rj - decapod-common pentest advisory (host recon)

  github.com
  GitHub
• GitHub Advisory Database - recent PyPI malware advisories

  github.com
  GitHub