MAL-2025-3464 Malicious code in request-wizard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ff748393cb55e78c43fea879bbd55034152148246aa8d45359cfa8517845e17c Importing the module starts an Infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-09-hyperreq...

Malicious code in colorbytes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 aa4677648d784f5460e80091c656719fc082e6ed9028940b407c97b0e78ff008 Extremely obfuscated code starts when importing the module, and then downloads the next stages and configuration from pastebin. They include a whole range of...

Malicious code in coffin-codes-2022 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6c58561bbec76769fed6ea31b26a57f72ff7242de59c7c6f297a14b56f9b547e So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by...

Malicious code in coffin-codes-net (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 df624a59b2cb5ef5cf295a7e63718bf7938250f59c5cda19bb6f43c40824e99b So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by...

Malicious code in dirutils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c67eead763edc5b56dadc5bfcec545f8799586732b861a6e661050d1165bc7e8 Package contains a compiled infostealer that is started instead of promised functionality --- Category: MALICIOUS - The campaign has clearly malicious intent,...

MAL-2025-929 Malicious code in gmacpyutil (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7522b589abf570f1591bcd3eb29e4a900791d28901d30c5b57f151e899f94839 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

MAL-2024-12329 Malicious code in pwnstar-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0b5a94b7cc47cb91bf552abe43f1a0d078ed5c6e668c5ff4caa8c4d9f6d14177 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in pwnstar-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0b5a94b7cc47cb91bf552abe43f1a0d078ed5c6e668c5ff4caa8c4d9f6d14177 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in test-packages1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5c5608702af52a2ca19f0b384036f76248848f4b4ddbe582631d85b3f5e77dca Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in mlc-llm-nightly (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bdf6d47b319cb60e32a6f2942beaa54bfe6ccc01bb72a8337f062746d49ace38 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in gmacpyutil (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7522b589abf570f1591bcd3eb29e4a900791d28901d30c5b57f151e899f94839 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in ateslassia (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7b3ae00037330440de3fd0b333720f254e1549b277a12df5d31fb7f70d771daa Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in gwinpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fdd3f3646435d9d7857a19999ffa38cdb99c04b4aa62177b1df6f2710b5412b3 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

MAL-2025-6436 Malicious code in ateslassia (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7b3ae00037330440de3fd0b333720f254e1549b277a12df5d31fb7f70d771daa Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

MAL-2024-11578 Malicious code in discould (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bb38a630a1e0c6e81089ebb95d407d438c932c26527fde69e9c304305d267ca9 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

MAL-2024-11550 Malicious code in cblines (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 80531e39cd96b75b32c7549840f7bc6984377765d9f9f663c0b560332b4e1b84 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in roinject (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 abe077384854dc3572befe16d9f41d68fec2a7dbbc8d38884c526bacf0447318 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in ezauto (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4d5e63bafe0b12244a82ffbde9bcf5eaf32ba47034bcd84168efb7f9e2becf9a Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in mumupatcher (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c629884f1972a86de285e5eda36f8ec8358c1b40d22922ad309a11174af5fca4 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in mumuplayer12 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f5e7ec41057042474a89cfaa47532d1f790110bc7ac08533ff4dbeea9ee91899 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...