MAL-2025-940 Malicious code in lan-clean (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b77907fa5398dac2959c2fa6cc7ab1c451a318803ca9efb40ea52487080609c3 During installation, the package collects quite extensive information about the host and has no other purpose. To avoid detection, the real code is put in a ZI...

MAL-2025-962 Malicious code in python-bitget-request (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bf787bcce66ad47046d93086a114a0f144b0f538b3d969fea6aea42b2312f58b Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the...

MAL-2024-11718 Malicious code in taoreg (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11652 Malicious code in otci-openthread (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11526 Malicious code in artifact-lab-3-package-0c8bce1c (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-913 Malicious code in datagov-harvester (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd1508013c2ef9abe7de7e4eb3bbdc492b545c3344ae4148b4e06165e8313229 The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-998 Malicious code in trove4j (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d9c0dbfcd94c11b086cf83f69796c321829bdd64c2ebe53d8f74a72d46e465b0 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2024-11693 Malicious code in reverse4343 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a90c21a3dc6b4091f1ccd6f17c99b1ec955954d2b78e93029e63c33f12ed3c7d The package contains only a reverse shell started on installation --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2024-11591 Malicious code in fantasia3d (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f10f9afba1ef30b6953feb1080d6bb4df24f967023631cf9d577e974ddb3d412 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11580 Malicious code in dreamfusion (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 daec888ce25f9bd9cea55776c72cf297d277b11e9dc13e4fa634dab5d11656e4 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11730 Malicious code in torchs-visions (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 55065e0cb0170fe8d242932d470508fb1013fa0cdba286b09bf8b239b3958533 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11614 Malicious code in imagedreamfusion (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a6d6718a5b7231657a334b5a35b2053de510f4c15bdf137085121d29b5086121 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11563 Malicious code in control4d-multiview (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 321b180fa280d3e3b92106f3a20c69267ee789a4966b78905b1588d17552d935 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11731 Malicious code in torchvisions (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 51134ba41129052e6c7163c273094867918aff7ffc9579a3834f3febb74b44d7 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11635 Malicious code in mnolith (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 207bbf082f73c1f6a049ee32f8cc0c74e31ea20c858caf879db53107132b9c4d A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11726 Malicious code in textmesh (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 52383e3b1f992e77e89a8e7a1bd2889ac6494d162a5068552737f6bb6f8efad6 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11543 Malicious code in bytebs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 443278bc9421868cfa1431a267241ecb62582b57285a1d5f093d7109e2d12288 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11600 Malicious code in ggghhhrrr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 28a551f5605f075f623a22621731c74e18e92b9e3eafef6d876457301fbeee20 According to the description, packages should demonstrate the dependency confusion attack. The realisation is, in fact, a spamming with packages having as the...

MAL-2024-11566 Malicious code in crypto-regex-gener (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3236b2ded0bd62e3958fa1c6257142248c46b75e64cdd0a90edd82ffba869335 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

PyPI Repository Found Hosting Fake Crypto Wallet Recovery Tools That Steal User Data

A new set of malicious packages has been unearthed in the Python Package Index PyPI repository that masqueraded as cryptocurrency wallet recovery and management services, only to siphon sensitive data and facilitate the theft of valuable digital assets. "The attack targeted users of Atomic, Trust...