EUVD-2022-54205

Malicious code in bioql PyPI...

EUVD-2022-0051

Malicious code in bioql PyPI...

EUVD-2022-7199

Malicious code in bioql PyPI...

EUVD-2022-54439

Malicious code in bioql PyPI...

EUVD-2022-0377

Malicious code in bioql PyPI...

MAL-2025-191892 Malicious code in terminalcolornew (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a555882888b9895fbe7575cc6121cad44600e17fb64d7551cacc33b29f2ae9f If used, the code attempts to take a photo using the computer's camera and exfiltrates it --- Category: MALICIOUS - The campaign has clearly malicious intent,...

Malicious code in onnxruntime-winml (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5566aa4ecc644b36e90902092563c05e1852d751381539398f2307ae1fbefae6 Package is just calling home and there is no other purpose --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything th...

MAL-2025-191806 Malicious code in onnxruntime-winml (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5566aa4ecc644b36e90902092563c05e1852d751381539398f2307ae1fbefae6 Package is just calling home and there is no other purpose --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything th...

Malicious code in private-evolution (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b0fcdd3ad61af1881ab9e5e8b9fb871a0e142868c0be585594fcd32b5f069f6c Package is just calling home and there is no other purpose --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything th...

Malicious code in xx-ent-wiki-sm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5ebf0745c51c955dbe898efb0f6b721f30dd75edc24b4ee234e8574cee3da9d3 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-191690 Malicious code in bh-25-req-ase (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ddd759ada90b89401904e23b4e8cbe6a3021baf3c34495150b4a713ca7063be0 If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens --- Category: MALICIOUS - The campaign has...

Malicious code in thisisthedaventestz (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d5f510bfda1aeb6999f77b06597e760e13d4058dab2a7f8620bf8c561db5d39c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-6602 Malicious code in torchao-nightly (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-6589 Malicious code in solidity-coverage (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-191689 Malicious code in backtradingbot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 117c24f5b7a0f5e4921e4478231a717ecca01748a5b266d8984e619f06173984 Running the installed entry point downloads and executes remote code. During the analysis, the code was switching to websockets, adding a startup script and...

Malicious code in backtradingbot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 117c24f5b7a0f5e4921e4478231a717ecca01748a5b266d8984e619f06173984 Running the installed entry point downloads and executes remote code. During the analysis, the code was switching to websockets, adding a startup script and...

Malicious code in hello-from-shiphero (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 00eb05ac59ee167606a053bd1ac9f705de178f9a576e6fe78bae415d599157b1 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-191821 Malicious code in prof-qux (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5b87af8d8f13bd43c1cf3490ea551b8d60fe05a482875597ef2fe5d2c200ca19 Package silently exfiltrates user's credentials ahead of starting the promised functionality. First batch used simple code, the newer attempt to hide...

MAL-2025-6010 Malicious code in ruamel-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1381375ccfff8dc10b3416284ac4a9a91c69bb2d5e7b652a2df24a64f4c5d512 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-193014 Malicious code in cas-base (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 69eb341218878aebdec66eb5a44391314921fe3c7fb387021d0684bbb91913b3 The package contains code to install remotely stored malware and ensure its persistence. The code is not triggered automatically; it requires a separate trigge...