MAL-2024-8023 Malicious code in artifact-lab-3-package-b6920ef4 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0239eb42a339ea04c20285cf4f4fd719e841f19d6e59a2cbb78f6e982fcea446 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...

MAL-2024-10038 Malicious code in jupiterhelper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a8e36ac6c995bb1a6fa9de762d459e8a108754dba767f6f3d19c385eb005b5e Once run, downloads and install from sleipnirbrowser.org a suspicious executable pretending to be a webbrowser. This website appears to be a scam using some ki...

MAL-2024-10037 Malicious code in jupiter-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3649d8b83ed867b05ae6721bd1158879d8e6a13e0ea9d80c7b6bd9d028dd8738 Once run, downloads and install from sleipnirbrowser.org a suspicious executable pretending to be a webbrowser. This website appears to be a scam using some ki...

MAL-2024-9937 Malicious code in aiohttp-libscss (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d5cb2d30b1084d16cbffd08a377d8723d794f112d1d33e666a4d4154653015e0 Imitate legit package, when used, sends out the URL of web application using the package --- Category: MALICIOUS - The campaign has clearly malicious intent,...

MAL-2024-10116 Malicious code in pyfetcher-vaaai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f237a360d6c502e99989196a60d6a7f7fc66731df01c9412c4d5e1eb00d7d8f9 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-vaaai-netflixchecker Reasons based on the campaign: -...

MAL-2025-5131 Malicious code in s3ffs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bcbd170ded254c386778d86dbd56a4d2fc5e7dfdeb37bd17fa2198e85e5c93c7 Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

MAL-2025-5144 Malicious code in whel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 556e14c71baa5758239b80d9333f83a0369b1169e63b027c50d633b97475136c Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

MAL-2025-5108 Malicious code in crypt0graphyy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ec94110581ca3363bda748a7d59e0e82110dda02ec61092f85e7ef2d513f059e Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

MAL-2025-5114 Malicious code in fsspecc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 90f4ad6035c504be5b282397b9a981d39fe71dcb0165be3b5d0571ac6274b51c Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

MAL-2024-10043 Malicious code in mecit2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c9131eebc14bbebfb234f0f0c49ca47882df2140d1061d201735c360b866a867 Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

MAL-2024-10044 Malicious code in mecit3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3b0998e3b9d6f9e46cd475fa5a18c38a48f7e3e72d02350d7431375fad7dd871 Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

MAL-2025-5143 Malicious code in whee11 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 457eb762160a23e220ee51c7d26f0b143c534243c23027ae0ae39be72af55cdb Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

MAL-2025-928 Malicious code in gandon-pidar1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4ac6e5875e2e378713032cdf0e35f5eef05d5f3967b4ec5e8c57759adb128b21 Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

MAL-2024-10042 Malicious code in mecit1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 84c154fb79729b15ec93f3c1f10fd3e06c1c312fae05df59a32c13172536e36a Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

MAL-2024-10154 Malicious code in reqests-2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 439152aa004a93a52d0010d5727e26fd0f7c5bf3cb65695cb96a86c2335d57bf --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, researc...

Leaked GitHub Python Token

Heres a disaster that didnt happen: Cybersecurity researchers from JFrog recently discovered a GitHub Personal Access Token in a public Docker container hosted on Docker Hub, which granted elevated access to the GitHub repositories of the Python language, Python Package Index PyPI, and the Python...

MAL-2024-10039 Malicious code in kongstrong (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6bc1ea7b99d0e9a3368a66084641ad782b9070c75c5ad2b67026cdd569ae344d --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-strongkong Reasons based on the campaign: - Downloads...

MAL-2024-10168 Malicious code in strongkong (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c6f4a55369b1ed2f46bdac2bc627a89816b7fafe22306d285b9d2f2d5cf120b7 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-strongkong Reasons based on the campaign: - Downloads...

MAL-2024-10166 Malicious code in solgpt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 24d27fe26b09bfe97b729a4d8a1a7b4e6f74cd69c17e0fa017eb07bccd3b5653 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-solgpt-exe-zip-miner Reasons based on the campaign: -...

Malicious PyPI Package Targets macOS to Steal Google Cloud Credentials

Cybersecurity researchers have discovered a malicious package on the Python Package Index PyPI repository that targets Apple macOS systems with the goal of stealing users' Google Cloud credentials from a narrow pool of victims. The package, named "lr-utils-lib," attracted a total of 59 downloads...