Malicious code in python-glue (PyPI)

Source: kam193 df7fb99f81d8afd1a93e643a95ebb6d2a873e73b15ae8c6fada22746ccf7037f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in python-drgn-commons-kafka (PyPI)

Source: kam193 4670119a917f9bceb7ba05fdebffa41c08377feb23c7bf5c102430de3c9cae40 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in python-binacne (PyPI)

Source: checkmarx 242390e4eac66fd15d4807033c99de1645afecae38d3d5c44e051d43c6d41454 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-bitget-wrapper (PyPI)

Source: kam193 769187e87797e69e9ebfc00eb97274a91fea1c86b1472b4ef6436441f737c8b9 Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by...

Malicious code in python-bitget-api (PyPI)

Source: kam193 cac6988c3746b27c0cc34a156657431c2a0c0c36de45c6b88a00130d30dfd66e Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by...

Malicious code in python-binaance (PyPI)

Source: checkmarx b32adc187b11f8baf0029d785f4bb61221cfab706d189f47c7c20d96e83bc736 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-biannce (PyPI)

Source: checkmarx d8240e2672f5130ce25db78c03e0b75bb8908b101ab4b40844ab155cdc7a122f Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-binancce (PyPI)

Source: checkmarx 25a34327f7e876dce537a24a4ce853da733326eb04ec4dbf128361269f830d2c Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-binnce (PyPI)

Source: checkmarx 7c65027f6e6423f46ecd68c1e4af4b8f189bd07c1ead019b94dfb4cfd3ba4bbf Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-bniance (PyPI)

Source: checkmarx d41b4b625fe1031afaf87ca4c8d1ee7684b6f977d7aa06c270408683abb0966e Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-binnace (PyPI)

Source: checkmarx 86246290cf88296fe430112459af77bd4a1fd3c85f132d169999083780b00462 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-bbinance (PyPI)

Source: checkmarx 495ce559970d6cd1920b9704dc242d6766f63cf4c7ae7718e9906d04d7e44ad7 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-amazon-doc-utils (PyPI)

Source: kam193 17e1f33275376bf6eef8f0ff4a1f42b8a45bada7b53462c827f397b7554bc2b0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in python-aliyun-sdk-core (PyPI)

Source: checkmarx 63f6387d6bfe7ae582be4478cf6a42a8104b44ea50b22489f5217ba2bfb3ce39 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security 100a505969357acd1d756a9df7eeb9150e1ffa1044b22cd739c11aab0b6c5d92 Attack targeted ...

Malicious code in python-binace (PyPI)

Source: checkmarx 686bb11ba44871d6fe3c11da5e0e3cd5366fb6e461b0682e27669d45f020e58b Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-cord (PyPI)

--- Credit: OpenSSF source...

Malicious code in python-anchor (PyPI)

Source: kam193 914b16cbc506c57a77eeed5ae14955bcf3b58fa49da92c2686b56a1d531c5268 During import, package decrypts and runs a malicious executable. The executable is hidden in an encoded and xored form in the JSON resource file. This is a follow up of the campaign 2026-03-fastapi-middleware-cors ---...

Malicious code in python-coinbase (PyPI)

--- Credit: OpenSSF source...

Malicious code in python-dateutil2 (PyPI)

Source: kam193 fbd1a31a38c7a6487545ce3e039371443c9ac80c7dc0ff9b22a46db6686244b2 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in python-binannce (PyPI)

Source: checkmarx 598a5676322f0a5625cec11d079811a6dac5c677e030289256210693cd0a7256 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...