Malicious code in graphicsx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3f85a722af04dc8f110fe530c6c3de3345ac2cf99b4e315d82cbbf0039c54660 Installing the package starts downloading and installing an Infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2024-12308 Malicious code in my-main-manager (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ac004ff76ebc011d60ae86c56b7f57ddb6ac0d24ff0ddd9ad777319775f79282 While the package appears to be a manager for Windows service, the linked executable is an infostealer with capabilities like cookie stealing ang keylogger. Th...

Malicious code in auth0-open-source-template (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c14dd94f3cdea34f9073f26be0716cfd944e0362396ae1dccab12196021a328c The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

Malicious code in bancor-simulation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8e9ecf6b613a42c070932a842fc4ebe81508d28adbb0aecee9aebe4e530acc0a The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-927 Malicious code in foop (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8dd063ab676114f4458052dd442285fb78dace9c91fd0b810c5c137cf3a4cb44 The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-901 Malicious code in auth0-open-source-template (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c14dd94f3cdea34f9073f26be0716cfd944e0362396ae1dccab12196021a328c The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

Malicious code in foop (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8dd063ab676114f4458052dd442285fb78dace9c91fd0b810c5c137cf3a4cb44 The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

Malicious code in crowdstrike-foundry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 89a436ce955b3eb01df1e23a27f7b9d0091b3720818f31559038c7af44bca276 The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

Malicious code in datagov-harvester (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd1508013c2ef9abe7de7e4eb3bbdc492b545c3344ae4148b4e06165e8313229 The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

Malicious code in calccc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 66371c79f4cedb638d8d283883415c46a4bf6be25e3699fe5229bc8cd71a2f0a Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

Malicious code in christmasmiraclemaker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 64f06a86dd5b916af92fc3adf5c1e5638df9eaa156a1bc122e4e647f2aae236e Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

MAL-2024-12215 Malicious code in bestcolorsever (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8335ea2981241d7eb1836338e2a942abf4f5096eb264b0ceb13e85ec435b6465 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

MAL-2024-12314 Malicious code in nirohf-reverse-shell (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c2b0a9ce248bca096b5109a73b943559cabbd6f77433d4a64cd1c804f7ec88df Installing starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in shoots-api-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78ebd73df4ce754b9e3a33af932d2b686a05716f83ccf3d7dd99029e73713acc Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2025-905 Malicious code in byted-df (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 821138aac758315c7a31a463523c4930bdd52e67699199e4c8bda0511c5907f8 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2025-985 Malicious code in shoots-api-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78ebd73df4ce754b9e3a33af932d2b686a05716f83ccf3d7dd99029e73713acc Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2025-960 Malicious code in pytest-tt-ddriven (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0fc281f8b24ee3d2420a1c1b3815d5c6a9a9420e0baebe4ea975d530181606a0 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

Malicious code in kotlin-stdlib-jdk8 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f217cf2fd34c9cab642b70bd9d778e6ef08a3dfba1954060a29983f2d3e6d47e Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2024-12231 Malicious code in ccsinstaller (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3e18cda71c2919c802b866f37fc87002396540fd6d3ea3f22b7703111c247518 Installing package downloads and install an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in dftester-pip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2e23c327cc9243e5437e6b31224c6796b90399065b451269641911b1d1982483 Example package with overwritten install command and the reverse shell --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...