Malicious code in yt-yson-bindings (PyPI)

Source: kam193 870d6e991bf31676829c84080af299f206568bc11d6f9b42bf5fe2dca50cb79d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in your-module-name (PyPI)

Source: kam193 6751268ea24120cf5830cfbc1948e7a8826069354e61bffc450257cf198ad38f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in youtubebot (PyPI)

--- Credit: OpenSSF source...

Malicious code in yvper (PyPI)

Source: checkmarx 53b17fd4f9f0d8f72d214b72683b4e65516bd40b5f724d1e615f4c325629c0cb Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in ython-binance (PyPI)

Source: checkmarx 1815eea4b2e4a66900c66905449b8b2700e562c0b4999693dc1a9117c8d2bb08 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in ypinstaller (PyPI)

Source: checkmarx 397167f79ccb3401a73a499723e7dd19f98f1e28e2d492660a2b84719ada306e Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in ypcodestyle (PyPI)

Source: checkmarx 5c9179a7e95371d31eb4fa1c785548c02eba03a736ebf5372a871b5ea2e8fd55 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in ytest-cov (PyPI)

--- Credit: OpenSSF source...

Malicious code in yfniance (PyPI)

Source: checkmarx 1a8f0724e257a37153444c6747aeef306ff749d14643666aa8bdc8d0b7707d90 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in xxoo-bale (PyPI)

Source: kam193 74ce2be8301ccea70138e307282fbf70ede26eede2a531296145f7d0da695b80 The package contains code to install remotely stored malware and ensure its persistence. The code is not triggered automatically; it requires a separate trigger. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in yfinace (PyPI)

Source: checkmarx 8fb9b040b8ad12632ab1cd1f6eaa89e250d0db7c044e2ab537e22b6b65c3a65c Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yellorq (PyPI)

--- Credit: OpenSSF source...

Malicious code in yeahmankema (PyPI)

Source: kam193 e82095096c026f9ea1f8a44e7b94b0f9def1346ef887a8a6bb4e11aedc5abd63 Package exfiltrates screenshots and network information to a hardcoded target. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-05-crayrandomiz Reasons based on th...

Malicious code in yfinancee (PyPI)

Source: checkmarx c0d8b13913b52dbfb6f31f935c5585cd960d6d2b93c6e123a1c3538845dd0ce6 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in xyq-drama-skill (PyPI)

Source: amazon-inspector 062ea591e5b995503deb15b174a37fc7af37cb5987a6c3d715d256fe0c3bfe10 setup.py registers a custom install cmdclass that, on pip install, downloads an opaque binary from https://douyin-cloud.tos-cn-beijing.volces.com/obj/hosts/log-helper to /.log-helper, sets it executable, and...

Malicious code in yfinane (PyPI)

Source: checkmarx 631a6721b969936d645d424f5d9aab2e3d59aea2a3c9857069873590eb36bd6e Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yfinancce (PyPI)

Source: checkmarx 00edde4921ae1d0da87c2f2709e60795118c8585066c23909a2a57efd0e5a485 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yellyproxies (PyPI)

--- Credit: OpenSSF source...

Malicious code in yfiance (PyPI)

Source: checkmarx 6c722a77439d6a24ce5b4c77e728ac92edde6c7327fc6849f363376cef1f1421 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in xxlsxwriter (PyPI)

Source: checkmarx 924d06d387de265c6ee7a08781831d7dfadfae7e1d3e4d94d6181705a5d15a1a Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...