Malicious code in zeubilamouche (PyPI)

--- Credit: OpenSSF source...

Malicious code in zatta (PyPI)

--- Credit: OpenSSF source...

Malicious code in zking (PyPI)

--- Credit: OpenSSF source...

Malicious code in zhopaorlaaato (PyPI)

Source: kam193 45a24b1a49c10f50578e74364357b8de8d31ee62b997c0db957bc0474c841fd7 Package is runs an Infostealer targeting telegram and Discord credentials. Depending on version, the infostealer is either downloaded from an URL or embedded in the package --- Category: MALICIOUS - The campaign has...

Malicious code in zakuraweb (PyPI)

Source: kam193 aa544044c8a113eb904f97650e8132de793d3bab5a7328a3714495e3f6a2283e Importing the module starts exfiltrating Discord tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-morosint Reasons based on the campaign: -...

Malicious code in yper (PyPI)

Source: checkmarx 572ea92561274df42888edb17d6d48d1f1208b6f4310880ec8a55215258c8382 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in ypsocks (PyPI)

Source: checkmarx d5cb708c793685c90220968f21e431d260d289a930660f30b0cb5c9554a446ee Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in ypthon-binance (PyPI)

Source: checkmarx f666c7f6fb138b62f3adf3f80b8f06547c71b2d41b1bced7ec1fc28f7f065d4d Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yzip (PyPI)

Source: kam193 81477965a8a70d1ffef0d388478d3e05ef2eea54ade0a9c00ef923deb41b00cf During initialization of the archive-support class, the package starts code from another file and downloads multi-stage malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in youtube-new (PyPI)

--- Credit: OpenSSF source...

Malicious code in yolov8mini (PyPI)

Source: kam193 a9222d20b84ed716d5bdf81f1da1d0f088fc7482894c8f25a5d1f757cc477ba9 On importing the module, there is an automated start of a Telegram bot capable of exfiltrating passwords from browsers, executing arbitrary commands and so on. While the description states it's a monitoring tool, the...

Malicious code in ytorch (PyPI)

Source: checkmarx 335f6f32b263cd0b67eecfa8dc1fc79608504d1d123f7c1a3145f4fa4aa65d64 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in ypj (PyPI)

--- Credit: OpenSSF source...

Malicious code in ysocks (PyPI)

Source: checkmarx ab40ffb51df00b2509d26bc0ce530329b87068e285153fbbd29dd094498625ef Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in zafira (PyPI)

--- Credit: OpenSSF source...

Malicious code in yyfinance (PyPI)

Source: checkmarx 35d5ed409824036fc8a52f2193726266e276f1458a5b1fd8c79044eba9590eff Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in ygame (PyPI)

Source: checkmarx 8bec58891df20b66c0009292e8832bfc76e16fcc2e720467c165d26e6b204740 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in zabitog (PyPI)

Source: kam193 23d4c7f55266f10f23ddf4a743bb4222b920c0e7f4472c1572a51831a3d1f247 Obfuscated code is used to hide exfiltration of basic data hostname, etc.. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring...

Malicious code in yuzo (PyPI)

Source: kam193 deb22bdfdecb739735dd50a5e0e2fe8329ee260b7236db8112629d7516d081d4 Package contains an infostealer and is clearly prepared for using it. Different versions present different variations, newer are based on CStealer. The exfiltration target is a hardcoded discord webhook --- Category:...

Malicious code in youreallydontwantthispackage2131 (PyPI)

Source: kam193 8bca93b1825c930118e85cc054305e6aef120080f8cc68233467eb6ee7b3ff1d Installing the package attempts to exfiltrate GCP tokens. As it uses a random names and/or targets specific accounts, it's most probably a pentest. --- Category: PROBABLYPENTEST - Packages looking like typical pentest...