Malicious code in qdatainstaller (PyPI)

Source: kam193 e4ee574ced05e27b63477cb84af816e02ae259c67246f4f31ff63819e7e1048e Package is designed to download and execute a remote script, which then downloads and runs a malicious executable --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in pythonhttp (PyPI)

Source: kam193 3ed5759c2260c5467724f053f3d59eac62f5491fc2d03350fef0a6f832652e3b Installing the package starts a heavily obfuscated Powershell Script that attempts to at least overwrite copied crypto wallets --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in python-rootpath (PyPI)

Source: kam193 bb867560d676e7b79ce110b230906a9630feb223cbcb6072bff5a2636c60a3c7 Hidden code downloads, saves and import a remote script. The package itself is a clone of a legitimate "rootpath". At the time of analysis, the remote script did not do any harmful action --- Category: MALICIOUS - The...

Malicious code in python-bitget-request (PyPI)

Source: kam193 bf787bcce66ad47046d93086a114a0f144b0f538b3d969fea6aea42b2312f58b Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by...

Malicious code in python-bitget-connect (PyPI)

Source: kam193 1797b7fdf9859888b5495817784ead0bdc01e6acad5ae410af1e1df89acbded6 Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by...

Malicious code in python-bitget-wrapper (PyPI)

Source: kam193 769187e87797e69e9ebfc00eb97274a91fea1c86b1472b4ef6436441f737c8b9 Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by...

Malicious code in python-bitget-api (PyPI)

Source: kam193 cac6988c3746b27c0cc34a156657431c2a0c0c36de45c6b88a00130d30dfd66e Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by...

Malicious code in pyrogrem (PyPI)

Source: kam193 42a10da9545ede038913b53b3619d36a94708a854536263f6a97c5d4d30a9b65 The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category: MALICIOUS - The campaign has clearly malicious intent, li...

Malicious code in pyrogrqm (PyPI)

Source: kam193 02c3334952bcf80c0523b20a24f0b744463a944a4f3d18dc45a3f3c1bd00c1eb The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category: MALICIOUS - The campaign has clearly malicious intent, li...

Malicious code in pydefender (PyPI)

Source: kam193 a1e2cc2d94eff74e302118c35c34f87e76175fe507facbe21c29883960c8223e setup.py is prepared to download and run an obfuscated batch script. While the script is not detected by any AV currently, in the sandbox analysis it reveals behaviour like adding exclusions to Windows Defender ---...

Malicious code in pyfiglets (PyPI)

Source: kam193 66caa962e9fedf67dff7c9da840c4a4dcdca71f237d2e36f332f5b5bd32750bc Malicious clone of pyfiglet. Importing the package starts a series of downloading and executing of obfuscated malicious scripts, partially identified by AVs. --- Category: MALICIOUS - The campaign has clearly maliciou...

Malicious code in pretty-cli-logger (PyPI)

Source: kam193 94cd11911ce2a0937d9e56087ce9487db18da5bb20df7f1f8948f8356d65c31d Contains an obfuscated code that will download and run a remote script. At the time of the analysis, the remote URLs were delivering empty results --- Category: MALICIOUS - The campaign has clearly malicious intent,...

Malicious code in pipmodule823 (PyPI)

Source: kam193 57b078ffca6f219848df2289282933442be06a2932d0d163ede59fe4a533faca If run as a module, the package downloads and executes a remote script. At the time of check, the remote script was just opening a popup; thus it's not classified as clearly malicious. Through the package description...

Malicious code in pipmodule83 (PyPI)

Source: kam193 95b01ea01a7fd1ff5e52491e6b143aa98f45a6f331814222fe38e76ad3ac0863 If run as a module, the package downloads and executes a remote script. At the time of check, the remote script was just opening a popup; thus it's not classified as clearly malicious. Through the package description...

Malicious code in piedefender (PyPI)

Source: kam193 f8a30e991bd97073c50a9cdabb10842f2c5ae074c46fcd0aeff5d7917d4b56fa setup.py is prepared to download and run an obfuscated batch script. While the script is not detected by any AV currently, in the sandbox analysis it reveals behaviour like adding exclusions to Windows Defender ---...

Malicious code in pdatainstaller (PyPI)

Source: kam193 671a0098c14338197a26cb64b7f5c35c0e741f3151313fff784bc7a4862ad579 Package is designed to download and execute a remote script, but the script itself seems to be broken missing or wrong URLs. It's most probably a test before next packages with real malicious content. --- Category:...

Malicious code in pathjoin (PyPI)

Source: kam193 a94ee2403006fa62b8cfd3e6ac5a3ae32f316ab9b32fd0dc47fefdca52cf5899 During import, the code downloads and executes encrypted payload from remote location. During analysis, remote code was prepared to download the next stage executable. This is likely selectively delivered to victims a...

Malicious code in openai-spellcheckers (PyPI)

Source: kam193 195e6ac284c1a3e97b7683250a5514ed89d903819d2a3c97987782d4725e0e9f Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for...

Malicious code in node-db-indicator (PyPI)

Source: kam193 7c9a18fe9ea04133e7de33313046092ffb5e8ccef6c1bf5f44e9b6d5e3835aa2 Code download and executes a remote script. At the time of analysis, the remote code just runs a notepad - as so classified as a pentest/research. --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

Malicious code in newpackagetest2024 (PyPI)

Source: kam193 1e2e6f858089751c96fa15bde74d24a4dc6a68758e3ee4870a9c0d1f7c66d378 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...