Malicious code in eth-security-auditor (PyPI)

Source: amazon-inspector 8e20bc5304d65563ad8b577a38c26db0b04746828b554f88cf5dd1215a214cf1 On import, ethsecurityauditor/init.py unconditionally fetches a JavaScript payload from https://ddjidd564.github.io/defi-security-best-practices/payloads/compliance-scanner-light.js using curl and pipes the...

Malicious code in dexscreener-data (PyPI)

Source: kam193 066a4d507cf7468384b144c7aa850b759abf3d38a02a609b42eed723f149f37a Code exfiltrates the current python code and/or IPythonshell history --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-solana-token Reasons based on the campaign...

Malicious code in dev-server-python (PyPI)

Source: kam193 77df2294feff074b86c685e622e69901b80eb16fdbf60eb785a026318d84788e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in dexscreener-charts (PyPI)

Source: kam193 46bedd3ee92a24c08ca1ab124f058e6b240b43c4cc9431ceccc8b2c050437b5e Code exfiltrates the current python code and/or IPythonshell history --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-solana-token Reasons based on the campaign...

Malicious code in credential-python-sdk (PyPI)

Source: kam193 6c6598ac9c321af3b0526ddceb5ffc6e78d593e0c3e6bdd259b06c0792705cc6 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in coolbox (PyPI)

Source: amazon-inspector c55bfdad112134e980af7568a9138be1e4b940f7bfbeebad2b0f85d9337a0f44 The wheel installs coolbox-setup.pth, a Python path-configuration file that Python auto-loads at every interpreter startup any python invocation system-wide, not just import coolbox. The.pth uses exec on an...

Malicious code in cobo-python (PyPI)

Source: kam193 2f1c1c4efd134e130c04178382ff3ea318301fb18b5eb6eed696c49cf64e9ad6 It appears to be a forgotten pentest checking typosquatting against cobo-custody package, but may also have malicious purposes. During installation, if a machine is Mac, an obfuscated code attempts to download and...

Malicious code in cmd2func (PyPI)

Source: amazon-inspector 055d480cc069717b82f618e12d453e7d8dc7d2e83bf77ae25ae23f71e73a1d1a The package installs cmd2func-setup.pth, a.pth file that Python auto-loads at every interpreter start. The single-line payload uses the.pth import-trick with or exec... and mangled single-letter identifiers ...

Malicious code in ci-metadata-python-logging (PyPI)

Source: kam193 b2ec44231abe88a238f040c6ed291532c456a0f07e91b5966a76b5262526672d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in chromifypro (PyPI)

Source: kam193 4138883ad2e38b4a8a4353918126f4732db5f04107be0bddafc745ec97120b52 Packages silently decrypt content hidden in a dependency and load them as Python extension modules. In the first wave, those are copies of legitimate aiohttp and aiohappyeyeballs packages. In the second wave, maliciou...

Malicious code in brotli-python (PyPI)

Source: kam193 3750f9d493198c7607b7f1d5855b6e8726edb24618beeb216e5a86a4a9119e5f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in bramin (PyPI)

Source: amazon-inspector 1fb2ac40fcb4626c5e7dea5e26951bc0965b39a1eb721c1a8f23846f421a5827 bramin ships a bramin-setup.pth file that Python auto-executes at every interpreter startup system-wide, not only when bramin is imported. The.pth contains a single-line obfuscated payload using single-lette...

Malicious code in blastchamber-python-pypi (PyPI)

--- Credit: OpenSSF source...

Malicious code in aurm-python-sdk (PyPI)

--- Credit: OpenSSF source...

Malicious code in asynhttp (PyPI)

Source: kam193 058c3bab076ccb770a3ecaefbdb301df88bd935a79f154cdeb329c51c4a1eef5 Packages silently decrypt content hidden in a dependency and load them as Python extension modules. In the first wave, those are copies of legitimate aiohttp and aiohappyeyeballs packages. In the second wave, maliciou...

Malicious code in args-python (PyPI)

--- Credit: OpenSSF source...

Malicious code in amzn-aws-glue-ml-libs-python (PyPI)

Source: kam193 e5986d73558862130dbb1317c6a92532786ec34f23d4d88c8fd6273198c5ce45 This is a couple of packages with names appearing to be a library for an AWS or other service. Their only behaviour is to call home on installation or import --- Category: PROBABLYPENTEST - Packages looking like typic...

Malicious code in anduril-lattice-sdk-grpc-python (PyPI)

Source: kam193 1baa043d99a594c81f1a153d2da1d69bc4a2e67181cdf491c2f06f65120089aa Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in anthropy (PyPI)

Source: amazon-inspector 8fa5e8904e682bfc10273961eb25b914c8d79b89e2a6c923c32bb9b3233d41c2 The package anthropy is a one-character typosquat of the legitimate anthropic PyPI SDK. The sole module anthropy.py executes a classic Python reverse shell at import time: it opens a TCP socket to...

Malicious code in aliyun-python-sdk-v2 (PyPI)

Source: kam193 29bd2455a576643c51939bd166abab847afd04c3142b576e3f9f0c7978763181 Series of packages impersonating Alibaba Cloud. Two oldest hide code to run obfuscated code, but are likely to be used as dependency as the obfuscated code is not inside. The newest describe similar functionality, but...