MAL-2024-11561 Malicious code in colourema (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11559 Malicious code in colority (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11554 Malicious code in ccl-localstoragerss (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11553 Malicious code in ccl-localstoragers (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11551 Malicious code in ccl-leveldbase (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11526 Malicious code in artifact-lab-3-package-0c8bce1c (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11521 Malicious code in akobo (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11515 Malicious code in afriton-py (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11516 Malicious code in afritonpy (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11514 Malicious code in afriton (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11513 Malicious code in afrit-name (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11512 Malicious code in 48484efej8id (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-934 Malicious code in huggingleg2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 19ba00b8fab08e8016af3bfb4ba9fbb18510b2aa823dfb82a46a5b3ecd477655 Installing the package starts a revshell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-12-huggingleg2...

MAL-2024-12309 Malicious code in my-service-manager (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 58c8e4c726cef11c6d7d60916210f532060a6ff7a98bb7fea5872eb10335dd5d While the package appears to be a manager for Windows service, the linked executable is an infostealer with capabilities like cookie stealing ang keylogger. Th...

MAL-2025-913 Malicious code in datagov-harvester (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd1508013c2ef9abe7de7e4eb3bbdc492b545c3344ae4148b4e06165e8313229 The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-900 Malicious code in apache-airflow-providers-edge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a9db9c9532f0405358d9eba42b9f1e7702f9d5f1878e60e1d6e0d94f7154368b The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-902 Malicious code in bancor-simulation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8e9ecf6b613a42c070932a842fc4ebe81508d28adbb0aecee9aebe4e530acc0a The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-912 Malicious code in crowdstrike-foundry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 89a436ce955b3eb01df1e23a27f7b9d0091b3720818f31559038c7af44bca276 The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-998 Malicious code in trove4j (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d9c0dbfcd94c11b086cf83f69796c321829bdd64c2ebe53d8f74a72d46e465b0 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2025-987 Malicious code in shoots-flutter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6a612693cb09ca6ca66ccd908b99293ec9ade7b7a719b78f0743332cba338071 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...