MAL-2025-934 Malicious code in huggingleg2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 19ba00b8fab08e8016af3bfb4ba9fbb18510b2aa823dfb82a46a5b3ecd477655 Installing the package starts a revshell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-12-huggingleg2...

MAL-2024-12309 Malicious code in my-service-manager (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 58c8e4c726cef11c6d7d60916210f532060a6ff7a98bb7fea5872eb10335dd5d While the package appears to be a manager for Windows service, the linked executable is an infostealer with capabilities like cookie stealing ang keylogger. Th...

MAL-2025-900 Malicious code in apache-airflow-providers-edge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a9db9c9532f0405358d9eba42b9f1e7702f9d5f1878e60e1d6e0d94f7154368b The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-912 Malicious code in crowdstrike-foundry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 89a436ce955b3eb01df1e23a27f7b9d0091b3720818f31559038c7af44bca276 The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-902 Malicious code in bancor-simulation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8e9ecf6b613a42c070932a842fc4ebe81508d28adbb0aecee9aebe4e530acc0a The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2024-10573 Malicious code in fabrice (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security d1d6b36980b1999e5525b7490b4a430c21cb4f86493a11b76f34ae8c02bfc19c The PyPI package fabrice is a malicious package typosquatting the legitimate package fabric. The package is an info stealer primarily...

Malicious code in byted-flex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f7c46f02d189ba471aba10b985193a2e0476f4f7f9f6e068ddf3fe79c2088ea1 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in compressi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ade0c38afdca5e7d87d6c3ecf059ed4a65e27587be0bff2287cbf4aa3474b536 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in huggingfaces-hub (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 030324e12766820002cc282dbac28f60bb0f2fc82d459e96c82f073a14e75592 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in importlib-resource (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0fd6066b0541bd12a7a24cd00cf0cebdc0d82832ae6ead0c90db2589bf50e152 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in midi-melody-extractions (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8cf5fe50a15b36c41406e9d04f254b0acae240897b5ad49b1165228613cb036a A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11612 Malicious code in image-dream (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5dc5a040f22951aa7352846d3518445c278d2c8aab44dcdf8435fd063e079957 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11594 Malicious code in ferminet-with-ecp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ee00c3ebd9a9dd393b6184c63072d81baa2ae968a831319453996dcf03d47999 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11638 Malicious code in monolit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4b004b665ba91ff3119a753e0b37cdce906d100aff101c2f536720bdd74fa027 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11634 Malicious code in midi-melody-extractions (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8cf5fe50a15b36c41406e9d04f254b0acae240897b5ad49b1165228613cb036a A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in bytepilot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c0d90c01bceedad5b420353d56d8b0d29f6571169ab91d9cda129f242e66c40b A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in tktoken (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 00d11ef99393eeb8899b4ce0fdcfc051f28305fbbe851e064eb984b21bb7c42e A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in bytesap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4eec30f2d541d35548fef109eb76c972e92203c749f615aa08f976fb9b0c2a03 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11663 Malicious code in pplgdfhuighsdfyisfgfd (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1b4e49a8011af86af7ac1b8cf4760295ddcf33d4b354139db3d92192e813dcc9 Installing the package attempts to exfiltrate GCP tokens. As it uses a random names and/or targets specific accounts, it's most probably a pentest. --- Categor...

MAL-2024-11662 Malicious code in pplgdfhuighsdfyisfdty2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b38f6d0da39d944ddde3bda8742a42099398148ad778fb06fe57e6a3274ea2e8 Installing the package attempts to exfiltrate GCP tokens. As it uses a random names and/or targets specific accounts, it's most probably a pentest. --- Categor...