MAL-2024-11640 Malicious code in mumuplayer12 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f5e7ec41057042474a89cfaa47532d1f790110bc7ac08533ff4dbeea9ee91899 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

MAL-2024-11609 Malicious code in httpsmovements (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1f6e48eea4c63cfcc19e892d140b0b70a48f1041c559effbaae92184fda61bc5 In the invokehttp, the init.py contains obfuscated code attempting to download and run one of two executables. They are identified as malicious by VT and the...

Malicious code in c2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5bf8fb109bddeaac7b9818f893783456619c44562c50fe26abea906cbc1ef06a Packages exfiltrate the diff of the current repository. The code in "main.py" suggests it's not a real attempt to provide AI-generated commit message, but a...

MAL-2024-12267 Malicious code in example-pypi-package-loler1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bb19218b6d780973bde55d613a16a9a637728a4d01e79d570bb3406633f0f639 Packages that might be part of testing for pentesting / malicious activity / joy, with suspicious activity that does not present any real harm. --- Category:...

Malicious code in example-pypi-package-loler1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bb19218b6d780973bde55d613a16a9a637728a4d01e79d570bb3406633f0f639 Packages that might be part of testing for pentesting / malicious activity / joy, with suspicious activity that does not present any real harm. --- Category:...

MAL-2025-959 Malicious code in pytc123 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 29916930efd9b23d2db0a812c00e77dcb672c494ae1d721e2201c1006625bf43 Packages that might be part of testing for pentesting / malicious activity / joy, with suspicious activity that does not present any real harm. --- Category:...

MAL-2024-12276 Malicious code in get-root (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1cb448108b11968d4fb13e0d12a3c089afa7eaeb7b288d6bc8e022ff1f4dd34a Packages that might be part of testing for pentesting / malicious activity / joy, with suspicious activity that does not present any real harm. --- Category:...

MAL-2024-12223 Malicious code in byterec-models (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a743bef3c7e21e3a83027eb77a9868e7b659f295c96c82ac735bc135b353e597 Collects basic information about the system, most probably a pentest or bug bounty. --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

MAL-2024-12362 Malicious code in thethreadingassistant (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 762eff7d2ce4176f6050d35736ba93b5853e8519e760522372aced785a146e59 Infostealer exfiltrating cookies, history and passwords from the Google Chrome browser, as well as attempting to do a webcam photo. Data are sent to a Discord...

Malicious code in artifact-lab-3-package-736f752d (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dfb249857a1fcf0c79636d8692dc8b148d847336022dbe6f4ab558f6f5c2f97f Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...

Malicious code in artifact-lab-3-package-6e10193e (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 be1776005a138f3a3c26df212fd9407dda2bb99a246703710810d30e6118ed79 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...

Malicious code in layoutspecs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8e98f53933a358e241d85c8222bb5093b52de69083969fc55de49b5ecc023050 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in cmdb-worker-pckg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f0039cc4672b957b253c70bf7a3d084574f8a10d21d6bc42d0fac2f2a3fd8400 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in tomli-dzw (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 83d4c8f45a091092f6ceb10a4cb2934e805ac096f6f1c983c49245b5f4d47ee1 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2024-11665 Malicious code in puffionerlolpo2131 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 80a02e95092a88f93b35471d27c9b913bd00100f9d34aa5b97983a717f4ce740 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-6428 Malicious code in 0x000testqwe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4c1f4407cfafbdc3391f55d6b0c6c7344e0e87cfc42f7eb6dfdd9239a82433b7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in pinloggertest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d5f6beadd08c32e5fd2f899428285a58ab3d696ef0fc06d2eff10e2d8630fa9a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-6512 Malicious code in google-appengine-ext (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 142a8fbc789954291f2b01aab5ac1d139eaaf4f9f490fd6dcf30da438f7d8e51 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-1968 Malicious code in d5e54nc32y1337 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 13cd8ff22129444670c5269677ecf7d1321f469f42b693571b5726537e1ffcec Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2024-11722 Malicious code in test-test-asd-1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f6284e15edda08ed04fabd1d9f958e5455bc0a60f3127b35f9f49ea8ee36a49c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...