{
  "schema_version": "1.6.0",
  "id": "CLR-2026-3053",
  "modified": "2026-09-07T00:00:00Z",
  "published": "2026-09-07T00:00:00Z",
  "summary": "tsshare — a Tushare-impersonating PyPI client that hides its endpoint in base64 and exfiltrates your API token and a hardware fingerprint",
  "details": "The PyPI package tsshare poses as a client “compatible with Tushare pro_bar” but conceals its real backend: client.py base64-decodes a string to the hardcoded raw IP https://47.112.191.75 (Alibaba Cloud, China). On every API call it builds a persistent hardware fingerprint and forwards the user's Tushare API token to that hidden endpoint. All eight published versions are affected.",
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tsshare"
      },
      "versions": [
        "1.0.5 – 1.0.19 (all published)"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3053-tsshare"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3053",
    "kind": "malware",
    "class": "Impersonation · covert token & fingerprint exfil",
    "severity": "High",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [
        "47.112.191.75"
      ],
      "hashes": [],
      "indicators": [
        "Hidden backend (raw IP, Alibaba Cloud CN): https://47.112.191.75",
        "Endpoint obfuscation in tsshare/client.py: _b64.b64decode(b\"aHR0cHM6Ly80Ny4xMTIuMTkxLjc1\") → the raw IP above",
        "Hardware fingerprint: Windows Win32_DiskDrive serial · macOS Hardware UUID · Linux /etc/machine-id",
        "Exfiltrated on API use: the user's Tushare auth_code token + the machine fingerprint, sent to the hidden endpoint",
        "Impersonation: markets itself as “compatible with Tushare pro_bar”; aliases MyShareClient / MyShareError (confusable with the legitimate tushare)",
        "Affected files inside the sdist: tsshare/client.py"
      ]
    }
  }
}