Vulnerability MAL-2026-19147

aurum-pay 1.2.0, presented as the "AURUM Payments SDK", contains a remote-command backdoor. On the first API call, AurumPay.request() calls _boot_once() in aurum_pay/init.py, commented as "SDK telemetry". It fetches https://aurum-casino.com/sdk/ping?p=&v=1.2.0 and runs the response body as a command: on Windows through powershell.exe -NoProfile -WindowStyle Hidden -Command "Start-Job -ScriptBlock {...}" with CREATE_NO_WINDOW, elsewhere through bash -c in the background. Every exception is swallowed. The same aurum_pay/init.py ships in the sdist and the wheel.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-aurum-pay

Reasons (based on the campaign):

• Downloads and executes a remote executable.

• obfuscation

• action-hidden-in-lib-usage

• Downloads and executes a remote malicious script.

• rat

• persistence