Malicious code in python-files-mod (PyPI)

Source: kam193 3f9a5cad398dbfcea1ea0ed1a7b20c678a67941581a4562aa92703ac86ee421a Disguised as file system manipulation library, the package hides an obfuscated code to communicate with a Telegram channel. Though the usage is not known at the moment, the package is clearly created for data...

Malicious code in python-drgn-commons-metrics (PyPI)

Source: kam193 55b40b067506b72f76abb433795eb9f30b5568c235ded94d855ef08769887d92 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in python-devplatform-client (PyPI)

Source: kam193 2b75d4d8e3c822aa82b716e6752c0901447845d442973ce9bc35c78b9c81c78a Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an...

Malicious code in python-project-wntliogu (PyPI)

Source: kam193 82bffbaa9f040ea19ff4e9fe678df68b1be71418f80fcd665ecc4f729512df19 Packages that might be part of testing for pentesting / malicious activity / joy, with suspicious activity that does not present any real harm. --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

Malicious code in python-drgn-commons-kafka (PyPI)

Source: kam193 4670119a917f9bceb7ba05fdebffa41c08377feb23c7bf5c102430de3c9cae40 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in python-drgn-commons-pandas (PyPI)

Source: kam193 ffa5a1e2c14a2a4190e5f837dfdd0ec9ad3f5579b22ec7c3717748acd76e46c0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in python-poller-ball (PyPI)

--- Credit: OpenSSF source...

Malicious code in python-glue (PyPI)

Source: kam193 df7fb99f81d8afd1a93e643a95ebb6d2a873e73b15ae8c6fada22746ccf7037f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in python-ibnance (PyPI)

Source: checkmarx 394ba970fef89b19a82aab6e01a5410d55846236ee30ffca1d606c9cd4603b57 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-eicar (PyPI)

--- Credit: OpenSSF source...

Malicious code in python-dateutil-malicious (PyPI)

Source: kam193 e746200736f98b51154e3cfbafa826ee92b8badb2005dac0e8fb4765cc3cbc57 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in python-guild (PyPI)

Source: kam193 e80e97d90a6fe86d94b3d80feac7f7f53e0eb1ee29320ebb7612cdf7a5449f3d --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: spl-types-rentry-2024-07 Reasons based on the campaign: - infostealer - crypto-related --- Credit: OpenSSF source...

Malicious code in python-cos-sdk-v5 (PyPI)

Source: checkmarx 9d23946b30370561c42df798c468626c8ec508cdf6f0fc22cc34bb67f2fa187e Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security d6fb33a1e6f9e43d03767e7893e2a99c65914fdf3d8aa3657c4aaf7bae91c861 Attack targeted ...

Malicious code in python-dependency-confusion-attacks (PyPI)

--- Credit: OpenSSF source...

Malicious code in python-module-installer (PyPI)

Source: kam193 61bfa181c5afb9e33e0d529138c813fc05d8130062182d9d1a5cb4ef9c8da0ea The package clones a legitimate webdavclient3 library and modifies it to be an installer utility. During installation, the package exfiltrates the current working directory to a remote WebDAV server or Telegram Bot...

Malicious code in python-drgn-commons-notebooks (PyPI)

Source: kam193 c58563ab9fa9e175fdc54c79fc0624acfb0f8e22b434bc66747858ce985b2500 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in python-kudu (PyPI)

--- Credit: OpenSSF source...

Malicious code in python-datetil (PyPI)

Source: kam193 ade289b57baa6b63431a9653e51023f1e631fbc0e36471acdb51c821410ea8dc Package consist of a revshell only. The effective danger is low as it's clearly designed to connect to a localhost only and be used as awareness. --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

Malicious code in python-drgn-commons-all (PyPI)

Source: kam193 3ce33648003ab87b87342b026af5cbeb8d8f3f759af0f8c7ae3557a104ec3546 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in python-drgn-commons-spark (PyPI)

Source: kam193 c5207bd91c5eab8a2ae9cda76c18027e600cbf015d01884048da00371577b3d1 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...