MAL-2026-11414 Malicious code in aiassistcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9561c11926b1e2d0a7f38f91edc062a77b27e624521dd7c1e500ef3c16a157a2 The package presents itself as 'AI assistant utilities' but its workspace.py implements two active attacks against the installer's Windows session. A...

Malicious code in aichannel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e51fdc38d5678b9b9a96014b69db1062b6ecc71b8986a837b4e9ba8d03d7214 Package connects to a hardcoded C2 socket server SOCKETSERVERHOST/SOCKETSERVERPORT from cognikit.config and runs a typed-message session loop that...

MAL-2026-11415 Malicious code in aichannel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e51fdc38d5678b9b9a96014b69db1062b6ecc71b8986a837b4e9ba8d03d7214 Package connects to a hardcoded C2 socket server SOCKETSERVERHOST/SOCKETSERVERPORT from cognikit.config and runs a typed-message session loop that...

Malicious Package

Overview @joyfill/layouts is a malicious package. This package contains a supply chain compromise that executes a malicious payload immediately upon import of the vulnerable versions. When loaded, the package uses decentralized blockchain resolvers Tron, Aptos, BNB Smart Chain to fetch and execut...

Malicious Package

Overview @joyfill/components is a malicious package. This package contains a supply chain compromise that executes a malicious payload immediately upon import of the vulnerable versions. When loaded, the package uses decentralized blockchain resolvers Tron, Aptos, BNB Smart Chain to fetch and...

Malicious code in zhopaorlaaato (PyPI)

Source: kam193 45a24b1a49c10f50578e74364357b8de8d31ee62b997c0db957bc0474c841fd7 Package is runs an Infostealer targeting telegram and Discord credentials. Depending on version, the infostealer is either downloaded from an URL or embedded in the package --- Category: MALICIOUS - The campaign has...

Malicious code in zakuraweb (PyPI)

Source: kam193 aa544044c8a113eb904f97650e8132de793d3bab5a7328a3714495e3f6a2283e Importing the module starts exfiltrating Discord tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-morosint Reasons based on the campaign: -...

Malicious code in yuzo (PyPI)

Source: kam193 deb22bdfdecb739735dd50a5e0e2fe8329ee260b7236db8112629d7516d081d4 Package contains an infostealer and is clearly prepared for using it. Different versions present different variations, newer are based on CStealer. The exfiltration target is a hardcoded discord webhook --- Category:...

Malicious code in web3-helpers (PyPI)

Source: kam193 8d6102ae402b2583a01da47e71f41cccba99fb7826dcf360004d8924557e1760 During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating crypto wallets and browsers data. Likely continuation of...

Malicious code in uconst (PyPI)

Source: kam193 cc4ce4d1709ad506513007356fd414ca83c1aa848f9134e952c4b760194428c6 Package "uconst" is the package containing malicious code with multiple stage, exfiltrating basic info as well as browser data. It's put into others as dependency. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in tq95 (PyPI)

Source: kam193 abb1e0b01bcc48bdbb798a617be723bf433722a7bede307de21214a92d569949 Importing the module starts an infostealer exfiltrating browser data, passwords, crypto wallets and implants a Discord stealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in sysfunc (PyPI)

Source: kam193 9dc5d09b08f080ad350524a6620877c69339aac5885f4ddb2cbaec68bfa2d3ee Importing the module starts downloading and executing an Infostealer targeting browsers' and Discord data In first packages, there was a hidden line triggering downloading and running an infostealer --- Category:...

Malicious code in syscontrol (PyPI)

Source: kam193 2c413668a48a55dfe9f01e94c01fcfa37b26660436d8281a4075884b1cadd06e Importing the module starts downloading and executing an Infostealer targeting browsers' and Discord data In first packages, there was a hidden line triggering downloading and running an infostealer --- Category:...

Malicious code in suyo (PyPI)

Source: kam193 c9b3fe60a21600a82fb46e53eeaf8e62998a5851821b70aac4b31433e79349d4 Package contains an infostealer and is clearly prepared for using it. Different versions present different variations, newer are based on CStealer. The exfiltration target is a hardcoded discord webhook --- Category:...

Malicious code in subsys-client (PyPI)

Source: kam193 cd448fe7b92604e9718438328baa70266ded0a4e0c105f7663c9256b6eeea18b Importing the module starts downloading and executing an Infostealer targeting browsers' and Discord data In first packages, there was a hidden line triggering downloading and running an infostealer --- Category:...

Malicious code in superline (PyPI)

Source: kam193 59df95892042deb7d9fd8ce71d1890aeafd0cdab2cb8bbc3948504e74ccae39e Importing the package starts an advanced Infostealer, probably Blank Grabber, exfiltrating browser data, wifi passwords, discord and games tokens, crypto wallets etc. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in solana-sdkpy (PyPI)

Source: kam193 fa656c982797b0a9ae09399aa3204b8925d4608935f9b563f498224bebf39b04 Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other, correct uploading URLs Some of related packages only tes...

Malicious code in rtcpy (PyPI)

Source: kam193 75bd7b21b8b27920b63ff14b07b761f57e72da9866682e4e49bd569e660215fd Importing the module starts an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-mescouilles Reasons based on the campaign: - infostealer -...

Malicious code in reqiest (PyPI)

Source: kam193 ae04fab0eca7fc7fee7494d9651df8a18dbe919cd8c0fa56522711b9f845aa25 Importing the module downloads and starts an infostealer attempting to exfiltrate data and establishing persistence through autorun directory. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in rbx1325382 (PyPI)

Source: kam193 966cc45844a609edfa292523c993aa173d39c710d8856c06f30d5d73d82f48e9 During installation, package attempts to exfiltrate browser data --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-rbx1325 Reasons based on the campaign: -...