Malicious code in telebot-infee (PyPI)

Source: kam193 660cdc2470d38cf51f0a232119dd9765cba56eb66412f12d3c09b40dd7bd8530 The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category: MALICIOUS - The campaign has clearly malicious intent, li...

Malicious code in tabullates (PyPI)

Source: kam193 499d47c3064299cb3d921b32ac9f22c2bab7b0b841b3de3a0cee3029625d5d26 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for...

Malicious code in tableapy (PyPI)

Source: kam193 7adeff5bc226723e8e3241a36596e3e99094553770deda5e89ac8caf7c0e0f01 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for...

Malicious code in tabletas (PyPI)

Source: kam193 27d102f1cf4d0e6b08e5e77aa57a2a436a49f782fe6571b2a8e8d114e10d968d Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for...

Malicious code in tableapys (PyPI)

Source: kam193 2aff2faef3705b6233a6df3d6b39f4f9b88ff522aa7c343cd8d36eb1a40405d6 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for...

Malicious code in tablescene (PyPI)

Source: kam193 75f24eaea6c977e93d35c431f9bedc66b7757fd5c5635425c28801dad3b50de9 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for...

Malicious code in system-integration (PyPI)

Source: kam193 106aadf74e260c98fb25e21fc8ff5bea93798cc75117200447687debe7f9fba2 When importing the module, code downloads and executes a highly obfuscated remote script. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-01-system-integration...

Malicious code in system-integration-toxi (PyPI)

Source: kam193 096a1a342309a85666ad92b45da1da18ca808e16c93819a3122b2c6bbc2a15d6 During importing the module, code downloads and executes a remote script. During the analysis of this package, the code was a placeholder, but the package is closely related to a previously published one, where the...

Malicious code in syschecker (PyPI)

Source: kam193 81ab746bf511a8c6c41c5776e5688c310a5255c65fda0fad65e31b1ed534dc91 Package downloads and runs an obfuscated bat file, which executes malicious activity according to VirusTotal results. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in swampo (PyPI)

Source: kam193 7b8e193e75e6ca7d387f21b53c251e6ee8791d9ec4ca3f37099e765415d36157 Multi-stage dropper. The "analytics" functionality fetches fake updates information that should contain the next URL. From it, a yet another URL is downloaded, and then used to perform TXT DNS queries holding the...

Malicious code in spellcheckpy (PyPI)

Source: kam193 063d67bbc510966bb83b63d1ba79a8279cf212b9028005800d6f2f99534eec46 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for...

Malicious code in solidity-build-guard (PyPI)

Source: amazon-inspector be62d73f7e4a6307ec5f0bac9b9543f9d73da696a4e67233057f77fd3cb6481c On import soliditybuildguard, the top-level init.py lines 11-24 shells out to curl to download a JavaScript file from a personal GitHub Pages URL...

Malicious code in set7 (PyPI)

Source: kam193 8e2e9040a08a54eb2600701e50e4137fd9959873e23cb5c6c4845e0a4f3f6564 Package downloads and suggest opening an obfuscated script, which is an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-set7 Reasons based on the...

Malicious code in selenium-integration (PyPI)

Source: kam193 50120169fb4cd982eb19b5dee69b1aa881d250d6bab46aaadb2746b92f0ec158 When importing the module, code downloads and executes a highly obfuscated remote script. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-01-system-integration...

Malicious code in rwoka (PyPI)

Source: kam193 601385385b682f6bdaa31c763e64c5fafb16f22df60acd266c9c7f23f73208ee The package contains highly obfuscated content, that install another, downloaded from a remote location obfuscated script in the installation path of the 'requests' package, and marks it as a hidden system file. In...

Malicious code in rowrapee (PyPI)

Source: kam193 398cfbdac2d3602a5c9836408942993c3f2bbcda911184825f01cf9937fb035e The package hides code to download and start malicious script containing malware, identified as adware. The triggering method seems to be PTH file, although it's not always present Given the time correlation, it's...

Malicious code in rowrap (PyPI)

Source: kam193 606ce541a3ef4a98e4e1639e96c6431e7ec83be6f987c640a63c03991eae4f6e The package hides code to download and start malicious script containing malware, identified as adware. The triggering method seems to be PTH file, although it's not always present Given the time correlation, it's...

Malicious code in roboat (PyPI)

Source: kam193 f04db4869c9e981873683b537f335c1f25c7c17c283315859699855a9c20816b During installation, the code attempts to download and start malware. Connected with the campaign based on the time correlation and other packages published by the author. --- Category: MALICIOUS - The campaign has...

Malicious code in robloxrequestsss (PyPI)

Source: kam193 8fb526f76dced232dadcfbfa9e2ff4e48e14d9d9600f692c08323f7c44922784 During installation, a remote, highly obfuscated script is downloaded and executed. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-10-discordmessager Reasons bas...

Malicious code in roboat-util (PyPI)

Source: kam193 869ea4b94181bc5ef23562a4d749b462fb7079112cca74072ee9036fb397921f During installation, a malicious executable is downloaded and run. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-03-rowrap Reasons based on the campaign: -...