xayoub-xctxteam 0.1.2

xAyOuB_XcTxTeaM, published on PyPI as xayoub-xctxteam, is a Free Fire game-abuse tool. Version 0.1.2 was published on July 22, 2026 and is still served as of November 7, 2026, about three and a half months later. Importing it starts an unauthenticated Flask HTTP server on 0.0.0.0:50019 and logs in twenty Garena accounts that ship with the package, so that a remote caller can drive invite spam at a player UID of its choosing from the host that imported the package.

What xayoub-xctxteam does

When a program imports xAyOuB_XcTxTeaM, the package immediately starts a Flask HTTP server listening on all interfaces at port 50019. The server exposes /spam?uid=, /stop and /status with no authentication and with cross-origin requests enabled. In parallel, the package reads the bundled accounts.json, which holds twenty Garena Free Fire account uid/password pairs, and starts a background login thread for each account. Each account is authenticated against the OAuth token-grant endpoint at 100067.connect.garena.com using the bundled credentials and a hardcoded client secret; the code then exchanges the returned token for Free Fire game-server addresses and connection keys from ggpolarbear.com hosts. When a caller sends /spam?uid=<target>, the package sets that UID as the target for every connected account, and each account repeatedly sends friend-invite and room-invite packets to the target about every five seconds. The host becomes an abuse source for a third-party game service under remote control, using credentials that ship with the package.

What the code does

• src/xAyOuB_XcTxTeaM/__init__.py:12-32 — _auto_run() is called on import and starts run_api() in a daemon thread.
• src/xAyOuB_XcTxTeaM/main.py:499-505 — run_api() starts the account threads and app.run(host='0.0.0.0', port=50019, threaded=True).
• src/xAyOuB_XcTxTeaM/main.py:459-473 — /spam?uid= takes a caller-supplied player UID and sets it as the target for all connected accounts.
• src/xAyOuB_XcTxTeaM/main.py:160-183 — each account's spam loop sends spmroom and SEnd_InV invite packets to the target every 5 seconds.
• src/xAyOuB_XcTxTeaM/main.py:413-439 — start_accounts() loads accounts.json and starts a login thread per account.
• src/xAyOuB_XcTxTeaM/main.py:243-263 — Guest_GeneRaTe() posts the bundled uid/password and a hardcoded client_secret to the OAuth token-grant endpoint at 100067.connect.garena.com.
• src/xAyOuB_XcTxTeaM/accounts.json — twenty Garena account uid/password pairs shipped in cleartext.

Timeline (UTC)

If you installed it

Uninstall the package and restart any process that imported it; importing it opens TCP port 50019 on all interfaces, and anyone who can reach that port can command the host to send game invite spam. Do not reuse the uid/password pairs from accounts.json; they are the project's own credentials and using them continues the abuse. The account threads run in the background and stop only when the importing process exits.