Malicious code in midi-melody-extractions (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8cf5fe50a15b36c41406e9d04f254b0acae240897b5ad49b1165228613cb036a A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11638 Malicious code in monolit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4b004b665ba91ff3119a753e0b37cdce906d100aff101c2f536720bdd74fa027 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in bytepilot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c0d90c01bceedad5b420353d56d8b0d29f6571169ab91d9cda129f242e66c40b A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in tktoken (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 00d11ef99393eeb8899b4ce0fdcfc051f28305fbbe851e064eb984b21bb7c42e A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in bytesap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4eec30f2d541d35548fef109eb76c972e92203c749f615aa08f976fb9b0c2a03 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11662 Malicious code in pplgdfhuighsdfyisfdty2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b38f6d0da39d944ddde3bda8742a42099398148ad778fb06fe57e6a3274ea2e8 Installing the package attempts to exfiltrate GCP tokens. As it uses a random names and/or targets specific accounts, it's most probably a pentest. --- Categor...

MAL-2024-11663 Malicious code in pplgdfhuighsdfyisfgfd (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1b4e49a8011af86af7ac1b8cf4760295ddcf33d4b354139db3d92192e813dcc9 Installing the package attempts to exfiltrate GCP tokens. As it uses a random names and/or targets specific accounts, it's most probably a pentest. --- Categor...

MAL-2024-11618 Malicious code in j5gnpfweguiwerbngpiutbgn0iutb0pfwfef (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 41b992b1717ae4c37710bfcb4b86d013ca8f3eb95dc9e06f47bdd813010db976 According to the description, packages should demonstrate the dependency confusion attack. The realisation is, in fact, a spamming with packages having as the...

Malicious code in j5gnpfweguiwerbngpiutbgn0iutb0pfwef (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f32453dbd5b2857fbf4766d0c1573b109be79c0013d276ecdfce38105c4580f9 According to the description, packages should demonstrate the dependency confusion attack. The realisation is, in fact, a spamming with packages having as the...

Malicious code in cipherbcryptor (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in artifact-lab-3-package-e90915e1 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious Package

Overview browser-cookies3 is a malicious package. This package contains a malicious code and uses "typosquatting" to bait unaware users to install it. Remediation Avoid using all malicious instances of the browser-cookies3 package. References - Security Blog Credit: Kirill Boychenko...

Malicious code in fake-usreagant (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ef713dc551a4b2eb9b0c94b270f4c214aa90e688076e15bb263b3bb5f3b8484b Package imitates the legitimate fake-useragent, however it has a few suspicious additions: fake.py L149 calls a function from 'urllib2' module, which contains ...

MAL-2024-11740 Malicious code in user-random-agent-user (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 593686652ece19b8d2d79006659b8392c347442f9a8403ef1b9f8a8bfa232925 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

MAL-2024-11565 Malicious code in crypto-regex-checker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a849790638e062a67e51026ebcd7d23b06a5cb901a1b74ce74bcf09762511538 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

MAL-2024-11517 Malicious code in agent-user-generate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 514af1dfd929068fabc7527812b99ec6a287c3601d7cf4ed1d29c55e74339fac Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

MAL-2024-12245 Malicious code in coffin2022 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2f875ec44c758a726a21474b433c8f43af3d2ee96a3bdcca60f75288316b95ae So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by...

MAL-2024-12243 Malicious code in coffin-codes-pro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa99dd73d11cc6b2756fb43cff1eb16f5f80b4ffd436dbfd635b8417f821c7ba So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by...

MAL-2024-12241 Malicious code in coffin-codes-net (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 df624a59b2cb5ef5cf295a7e63718bf7938250f59c5cda19bb6f43c40824e99b So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by...

Malicious code in pytskcheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 25d82b24b022549617724628ccd6d11da9cc713daffc187cc3531b5bf3ef07e8 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...