Malicious code in yelp-pkg (PyPI)

Source: kam193 fdea5ca17bb09234a292159e525a2a38ac3fd43760c6f2184aa27f563f320075 During import, the package attempts to exfiltrate potentially sensitive data. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: GENERIC-questionable-pentest Reasons base...

Malicious code in xx-ent-wiki-sm (PyPI)

Source: kam193 5ebf0745c51c955dbe898efb0f6b721f30dd75edc24b4ee234e8574cee3da9d3 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in yfiannce (PyPI)

Source: checkmarx e1ec36fa05ae5a283ab5876ab46b7307969ffcb7c2f2b0ac42038b30facc09ca Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yfinnace (PyPI)

Source: checkmarx 633b0bbf0b39b789e685d5176aa31c7bf6d1c520326f3edb8d94f602513054f1 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yfinacne (PyPI)

Source: checkmarx 83f90f1335de6525d7c34d7d1fe32c807964daff9ce061822f0e18a96ab4bf66 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yc-depconf-test-807dff (PyPI)

Source: kam193 fe18d1e58fe7fbcd1a68dc26d47c9fa27f9678cf4bc50e3aa4ad35b16d0f85ce Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in ycodestyle (PyPI)

Source: checkmarx fffb5ae3e1f41a6b55f5c5ce485edd1290ef043de7ee30f907a21dc4ccb016b0 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yfnance (PyPI)

Source: checkmarx 174c68615790da014be30fdff340b46f2b564d041b5c7853075496d20b614284 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yfiinance (PyPI)

Source: checkmarx 394a01240f4d0094c45e18fd2c23bc1c5b3e1812329f2184bc0f873602699922 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yfinnce (PyPI)

Source: checkmarx c19b5cb2a8d7decd10e3261bce660d1f39d786e3bfa05786b2aed292562b4a1b Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yc-as-client (PyPI)

Source: ossf-package-analysis 9df89f5f0260f38e93635cc5df99e7ea267d4c07f25e1446a49c08fdf21befe7 The OpenSSF Package Analysis project identified 'yc-as-client' @ 11.11.3 pypi as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activit...

Malicious code in yeshsurya (PyPI)

Source: kam193 94ee8d39c76b11ebb68503181be81cfc3154ef7c1b758a9b139d77f3791c3356 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in yfinnance (PyPI)

Source: checkmarx b7a38ccdca93d7c136aa29f82ca37564a4cc93a9794a54db65323a6d5fba7586 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yfinanec (PyPI)

Source: checkmarx d81489f6e919c12171b1655da889187a032f7ef27746fdfc6dda5c9b811e994b Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in xuiniadb (PyPI)

--- Credit: OpenSSF source...

Malicious code in yfinaance (PyPI)

Source: checkmarx 0d96b45966d6504800ebc9093a29e66ef1c46f59323f59cbd0d1d384ffcb7f93 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yhaplo1 (PyPI)

Source: kam193 ea4e6c1525395c0b55d0de437d61b31250561c4901199518e13cd28fe15f232f Dependency confusion attempt. The user identifies themselves as a HackerOne user abusing the PyPI for the purpose of a bug bounty program. This package did not contain any exfiltration activity. --- Category:...

Malicious code in xwormclient (PyPI)

Source: kam193 4a6c0b4ce2747e70d2e9f46f624188d4da6a70af3182e6e94b22de7446dc180c Importing the module downloads and executes widely recognized malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-08-k7eel Reasons based on the campaign: -...

Malicious code in xxx-bale (PyPI)

Source: kam193 1109b5dc74c94551027044e54e20f9c1c18f89d53da6af87861ba4773eae1966 The package contains code to install remotely stored malware and ensure its persistence. The code is not triggered automatically; it requires a separate trigger. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in yelp-cgeom1 (PyPI)

Source: ossf-package-analysis f1d368f32894c442f86028103800df96e8818dd226ac82b14b5cec80a267a202 The OpenSSF Package Analysis project identified 'yelp-cgeom1' @ 0.1 pypi as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. --...