MAL-2024-11581 Malicious code in embeds (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46ae6a18503196c40e7fd1759d8a68025e6a980a64821c2a1232b7f76fbc2779 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

MAL-2024-11640 Malicious code in mumuplayer12 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f5e7ec41057042474a89cfaa47532d1f790110bc7ac08533ff4dbeea9ee91899 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

MAL-2024-10119 Malicious code in pyloy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 44deac488d2a8cdb533662db66592095a36ab35a491b4e9415c597cde0d37eab Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

MAL-2024-9966 Malicious code in dahood (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b9cc2a4186b5ad68e11dc68aa719583b8f3a746c9f13b8b3b950f9653df0e909 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

MAL-2024-10159 Malicious code in rolib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b16e729f1b088aa209bed8297f772d9b51eccf7c434e2a3b8aa3ff43f17f565e Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

MAL-2024-10158 Malicious code in roinject (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 abe077384854dc3572befe16d9f41d68fec2a7dbbc8d38884c526bacf0447318 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

MAL-2024-9943 Malicious code in artindex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3f19c3c0f0a7d0edd2a53f7c3879706561e0e7d4596b11e9eebbb1d896e90a46 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

Researchers Find Over 22,000 Removed PyPI Packages at Risk of Revival Hijack

A new supply chain attack technique targeting the Python Package Index PyPI registry has been exploited in the wild in an attempt to infiltrate downstream organizations. It has been codenamed Revival Hijack by software supply chain security firm JFrog, which said the attack method could be used t...

pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-43.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20240903.txt. If you are...

GHSA-2R6G-7R83-JG72 `spam` project on PyPI compromised, malicious releases made

The spam project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

`spam` project on PyPI compromised, malicious releases made

The spam project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

GHSA-X6XG-3FJ2-4PQ3 `exotel` project on PyPI compromised, malicious release made

The exotel project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

`exotel` project on PyPI compromised, malicious release made

The exotel project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

PT-2024-40032 · Pypi · Spam

Name of the Vulnerable Software and Affected Versions: spam project on PyPI affected versions not specified Description: The issue concerns a compromise of the spam project on PyPI via a phishing attack, leading to a malicious release that downloads and runs malware at install time by accessing...

MAL-2024-10184 Malicious code in utilhttp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f91f83da1ea0307373682776ad3de3a3fd320d57280f40fa82f47aaf316d3062 In the invokehttp, the init.py contains obfuscated code attempting to download and run one of two executables. They are identified as malicious by VT and the...

MAL-2024-10028 Malicious code in flophttp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 45ad705b0505a09a4123e74a68d03c4a16dd91604a6d9ab323eb0d776320f68a In the invokehttp, the init.py contains obfuscated code attempting to download and run one of two executables. They are identified as malicious by VT and the...

MAL-2024-10048 Malicious code in modernreqs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 39c894cc5c48e2c1485dce3f861ccf0b768aeafeddf6e865ec8ef8db7b1407a0 In the invokehttp, the init.py contains obfuscated code attempting to download and run one of two executables. They are identified as malicious by VT and the...

MAL-2024-11609 Malicious code in httpsmovements (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1f6e48eea4c63cfcc19e892d140b0b70a48f1041c559effbaae92184fda61bc5 In the invokehttp, the init.py contains obfuscated code attempting to download and run one of two executables. They are identified as malicious by VT and the...

MAL-2024-9264 Malicious code in crustyhttp (PyPI)

Base64-encoded commands are executed from init.py, which exfiltrate Telegram session data. --- -= Per source details. Do not edit below this line.=- Source: kam193 806b071147126057a7de9b570f85f694ad06923e4d580ddd5274731b5343f556 In the invokehttp, the init.py contains obfuscated code attempting t...

MAL-2024-11531 Malicious code in assaulthimars (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7c588101b33f530e5b4d8504f4a9cf1353eec7356231e9f4137ab1a187b780d5 In the invokehttp, the init.py contains obfuscated code attempting to download and run one of two executables. They are identified as malicious by VT and the...