MAL-2024-11522 Malicious code in alfooou (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5bb42c1e46cc4a000429770c7e316646bab8170a9f1191e3f196a4f05a65605f Running the module triggers obfuscated code that downloads a DLL containing reverse shell and injects it to a benign process. --- Category: MALICIOUS - The...

MAL-2024-11744 Malicious code in viplotlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2613f1ba2960b7e0358efd0c3e8cf7977619c4c21f485a57bc5244e063cdf1db Running the module triggers obfuscated code that downloads a DLL containing reverse shell and injects it to a benign process. --- Category: MALICIOUS - The...

MAL-2024-11712 Malicious code in spider-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 aaeb144e288d0288f6013d64f0e9e57164e5c3eded3924fd2282577b59c28f1a Every time the user sends a message to the AI, the user IP, message as well as the response are exfiltrated to a hardcoded telegram channel. This behaviour is...

MAL-2024-11728 Malicious code in titan-osint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e8dccaf6be8892f2b8871e634607d1dafc9fbb2b5855156959c454b07ab184aa osint packages promise to be OSINT tool, however, when providing the username to search for, the package attempts to exfiltrate Discord tokens from the user. T...

PyPI Repository Found Hosting Fake Crypto Wallet Recovery Tools That Steal User Data

A new set of malicious packages has been unearthed in the Python Package Index PyPI repository that masqueraded as cryptocurrency wallet recovery and management services, only to siphon sensitive data and facilitate the theft of valuable digital assets. "The attack targeted users of Atomic, Trust...

New PyPI Malware Poses as Crypto Wallet Tools to Steal Private Keys

Checkmarx researchers discovered PyPI malware posing as crypto wallet tools. These malicious packages stole private keys and recovery…...

MAL-2024-9067 Malicious code in website-scanner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bab4a414e51f614858ff935138ccb2632b0ba1801566c398a699e692715ccaae The obfuscated code in setup.py on installation collects information about the system all possible about hardware, available resources, IP, names, etc. and sen...

Trouble in Da Hood: Malicious Actors Use Infected PyPI Packages to Target Roblox Cheaters

The world of gaming can be a cut-throat place, with many players turning to online help via third-party programs ‘game hacks’ to get ahead. Although some of these programs offer legitimate game boosts, malicious actors frequently leverage these game hackers’ interest in modifications to deliver...

MAL-2024-11560 Malicious code in colotama (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa7312f48aedc863c1eb3377178692b7cb1fe1503114d3cbc6cdc97572b9a6c0 The pyprettifier library has a feature to send out the user home path throuh the logger. It's attached to the init of EmojiConverter class. Other related...

MAL-2024-11568 Malicious code in cryptograohy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 67095679f8af3205e005b17a996da2ba17789715d7c66e4fcf31d8c387b85c00 The pyprettifier library has a feature to send out the user home path throuh the logger. It's attached to the init of EmojiConverter class. Other related...

MAL-2024-11535 Malicious code in bibit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e944b3bd6b920bf1cfd786ed25cc65b504bd5701203981a460a9c162a0fc282d When running the module, this package attempts - depending on the version - to exfiltrate user files, a screenshot, or crypto wallets data 8.1.4. Later continu...

MAL-2024-9022 Malicious code in saywh11222 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 66e2b9f8537aaebeea0768739ff431e4fe4c8dc5ea9bab0d191d6f555384b25f The OpenSSF Package Analysis project identified 'saywh11222' @ 0.0.1 pypi as malicious. It is considered malicious because: - The package...

MAL-2024-9005 Malicious code in saywh222 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 776c407a0a9a3c3b242d222e9b22ada03db555fd91538182fdc5d059b1ddcae7 The OpenSSF Package Analysis project identified 'saywh222' @ 0.0.1 pypi as malicious. It is considered malicious because: - The package...

MAL-2024-9002 Malicious code in saywhu (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 67dc65eeb23101b56981a723f315b344ac7ba4773b9a712f82009fbccea7b430 The OpenSSF Package Analysis project identified 'saywhu' @ 0.0.1 pypi as malicious. It is considered malicious because: - The package communicat...

MAL-2024-11716 Malicious code in sunrequests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 314b140727c2d65586134b9e2722bdbba66be25e0f391d1b886cc08824783c63 Running the module starts an infostealer attempting to exfiltrate credentials from webbrowsers --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2024-8946 Malicious code in rcebymrx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 65ddcbfb52d8c96bb51c713d62841675f75e9e5225efc9380917c6cf79bed8ab When importing the module, the /etc/passwd file is exfiltrated --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anythin...

MAL-2024-11705 Malicious code in setuptolos (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 89f6c10eb8edc13e9f46c33bba334822fbb3693527f3fc89714bd86adc3be1af During installation, a cryptominer is secretly installed and started. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2024-11540 Malicious code in botoceor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8bf39054053dfe99fc83c836bb407659d11241cc09f2572a72524d980b9c5914 During installation, a cryptominer is secretly installed and started. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2024-11732 Malicious code in torhc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 385cb451ed567a10096fce231790d6a9bce59bb47c8d7bdfff5a8f4aaa0854ed During installation, a cryptominer is secretly installed and started. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2024-9944 Malicious code in asciidrawing (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 633d53a1b6bcde673f71f2788cc6c268f7eef20552eb7a0dc3f533f6a9a7ad12 During installation, a Discord webhook is used to exfiltrate basic data. The package seems to attempt impersonating the "asciidraw" package some files and...