Malicious code in zlib1g-dev (PyPI)

--- Credit: OpenSSF source...

Malicious code in zlsrc (PyPI)

--- Credit: OpenSSF source...

Malicious code in zydnitro (PyPI)

--- Credit: OpenSSF source...

Malicious code in zorosnitro (PyPI)

--- Credit: OpenSSF source...

Malicious code in zproxy2 (PyPI)

--- Credit: OpenSSF source...

Malicious code in zmaker (PyPI)

Source: kam193 2f4ac88a121488df2fdfa1cb5409f3443f658a30d679f20acc41dd2c656bd3b8 Campaign is split into multiple packages that altogether exfiltrates data from desktop Telegram application. 1. "pyapiepo" is a cover package that provides some useless features BUT also imports "zscaner" 2. "zscaner"...

Malicious code in zsender (PyPI)

Source: kam193 64454f4348553cc0321094cffaef685d8977dd95ccf1c07dc54e2b8b3c39a8f0 Campaign is split into multiple packages that altogether exfiltrates data from desktop Telegram application. 1. "pyapiepo" is a cover package that provides some useless features BUT also imports "zscaner" 2. "zscaner"...

Malicious code in zero123 (PyPI)

Source: kam193 af7d2c3f3831618ff17940011336fa3910db4cc1a28c37a7a8892fbfd8aac854 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the username to the package author. There is no other purpose...

Malicious code in zelixnitro (PyPI)

--- Credit: OpenSSF source...

Malicious code in zip-me (PyPI)

Source: kam193 4ae48b0e5e3d93cee49e83f0bfa47a43f02ede60914545d0d82204c6664fde6f During installation, the package collects quite extensive information about the host and has no other purpose. To avoid detection, the real code is put in a ZIP archive and includes also some VM-detection techniques...

Malicious code in zebo (PyPI)

Source: kam193 27f62f0f9a2a11b03c5bbead202d9f5d58ca471041e3115eb67dd88accc22be4 Package automatically installs a script with keylogger and screenshots extraction, and sets it for an autostart. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in ziugxfbvo (PyPI)

Source: kam193 257409f82e56689d4cd8ebe7ac8ae8e09203ecbd7eab311970e4bdeb7be92b05 During import, the package automatically downloads and executes code that first acts as an infostealer and then starts code acting as a RAT. It connects with a hardcoded C2 server and waits for commands, supporting e....

Malicious code in zakuchienne (PyPI)

Source: kam193 6cab2f6ce1c1eec52747b1f7057550b9b35d3c4f6d8c04b51e37afd47c1e5625 Importing the module starts an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-mescouilles Reasons based on the campaign: - infostealer -...

Malicious code in zlapp (PyPI)

--- Credit: OpenSSF source...

Malicious code in zamino (PyPI)

Source: kam193 c9ada91851d5e9411f5c74d5ea595be092fc2e4d2e8f7f7c995b6fbb6bd90d00 Clones of libraries to access Aminoapps e.g. legitimate package amino.fix with added exfiltration of the given credentials --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in zhpt1cscoe (PyPI)

--- Credit: OpenSSF source...

Malicious code in zipf (PyPI)

--- Credit: OpenSSF source...

Malicious code in ziggonext (PyPI)

--- Credit: OpenSSF source...

Malicious code in zefkopzekfo (PyPI)

--- Credit: OpenSSF source...

Malicious code in ziphash (PyPI)

Source: kam193 e9a36a54bad10e0f086740a84fd0a837dd4bf1cc9c3c0707648af4bb3855a03e During initialization of the archive-support class, the package starts code from another file and downloads multi-stage malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...