Malicious code in python-binanc (PyPI)

Source: checkmarx 3562136a5d3ae322013426909d6b26e4ef76c73eeeca707d6fcca0e2d956640a Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-binane (PyPI)

Source: checkmarx 01b3211dc7a31c66978e18d22ec87368bcee15b995791003053b27125f4566ce Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-biinance (PyPI)

Source: checkmarx d9ff96b34112795fae6523d6d376b51e11fc5166f8be37e46a5c53ea666df717 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-biance (PyPI)

Source: checkmarx 19dff21c4a586c682709e1777a100c0cfabe7bdfcdfbf744473d02a13dfa4e4e Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-aliyun-sdk-ecs (PyPI)

Source: checkmarx fcb822b0528f2cbde54bd2197ed8c774dda8cafc7c3e9ae5aff56465e7c6c72c Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security 68fc577518eac5e23447df7ccb71f78c102fb3277d85b6d868db42ab2414fe4b Attack targeted ...

Malicious code in python-aliyun-sdk-kms (PyPI)

Source: checkmarx 53bdcdc5414f25435cd821a9217982c4b486c91100caa324a9c3613d4ccd8d42 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security 4b0a37d9408528e981948fc9fa594b68b02980adbd851742fd03422ff814a7d7 Attack targeted ...

Malicious code in python-bitget-connect (PyPI)

Source: kam193 1797b7fdf9859888b5495817784ead0bdc01e6acad5ae410af1e1df89acbded6 Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by...

Malicious code in python-binanec (PyPI)

Source: checkmarx e1e80d6ff31f74988d4c9d589a6efec42045b3222230237b5d05e721b6ce4404 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-bittensor-config-v2 (PyPI)

Source: kam193 6f2ecdbc9e024d6dc51c8e5d48941c5aac432db65ad733317aed159d480973cd During installation or import, package silently adds a new authorized SSH key. It's closely related to the 2026-05-ninja-core-utils campaign, but there is no built-in crypto exfiltration. --- Category: MALICIOUS - The...

Malicious code in python-dateitil (PyPI)

Source: kam193 f7d09226c2d76a03909b10c844a44149abf2606a5f1f55232ee7620580835787 Package consist of a revshell only. The effective danger is low as it's clearly designed to connect to a localhost only and be used as awareness. --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

Malicious code in python-aliyun-sdk-rds (PyPI)

Source: checkmarx 56906386c88b620607253fc1d00a6d5d205c6a535a2ba12fc63108f09761300b Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security fad9f833ea9884cd2de7c1e26977adb4c84c650ad954cbfa25b0af0aef09eeee Attack targeted ...

Malicious code in python-bnance (PyPI)

Source: checkmarx 7674bd9c739135f5592a3d27acdaf9f93b8c6bd2da40c5ba462ac22ce24daf3d Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-binnance (PyPI)

Source: checkmarx 6a6cb930548a6aa50d0c90e61a4fb9d3fb6862161800e56759ce144ea4cb27da Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-binancee (PyPI)

Source: checkmarx cb19678f6ee14cc06992be0ee24dc55689ed837182f0f11b1c7ef66a8d440983 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in python-cookies-shower (PyPI)

--- Credit: OpenSSF source...

Malicious code in python-consul2-hh (PyPI)

--- Credit: OpenSSF source...

Malicious code in python-alibabacloud-tea-openapi (PyPI)

Source: google-open-source-security 1a75cd94261db49f7ab1e359b2579e7645756a48f20eb6a49465f980f5c2b43d Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategicly chosen functions and would only trigger when these...

Malicious code in python-aiogram-telegram-updater (PyPI)

Source: kam193 94b286136c318836563c0eaddf44e8d1b21f217086b444a3266d91b69ace79b8 When run, the package exfiltrates files from a cryptowallet and modifies its executable placing an implant exfiltrating passphrase later. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in python-alibabacloud-sdk-core (PyPI)

Source: google-open-source-security 1384f0a4ed6515eb7e720621346f74f53217b73863f4c5e3cda4fc90b52f49e3 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategicly chosen functions and would only trigger when these...

Malicious code in python-aickerso (PyPI)

Source: kam193 d1d7d33d48c083d0e17d3a3698d815f66dffb070f743e030278059a558c5e6fd Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...