MAL-2025-41785 Malicious code in totallysafe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 772cdbb82e78ad30e8f4cb0bcdd45aaf61884da051a9998fd1c1431335d0eaf7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-41667 Malicious code in dsodelib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b3646fafa7dac849bdfcdc6c760d037132c5231f61a87721b2a433992a3d3639 Package is runs an Infostealer targeting telegram and Discord credentials. Depending on version, the infostealer is either downloaded from an URL or embedded i...

Malicious code in dsodelib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b3646fafa7dac849bdfcdc6c760d037132c5231f61a87721b2a433992a3d3639 Package is runs an Infostealer targeting telegram and Discord credentials. Depending on version, the infostealer is either downloaded from an URL or embedded i...

MAL-2025-41668 Malicious code in dziplib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4330efb5db5e6d840d35a3da3ca6f6ad39fadff7e37e78745b9e092d365a7ded Package is runs an Infostealer targeting telegram and Discord credentials. Depending on version, the infostealer is either downloaded from an URL or embedded i...

Malicious code in dziplib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4330efb5db5e6d840d35a3da3ca6f6ad39fadff7e37e78745b9e092d365a7ded Package is runs an Infostealer targeting telegram and Discord credentials. Depending on version, the infostealer is either downloaded from an URL or embedded i...

Malicious code in dsidelib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5bd949196aad0e516b6c21fb6c9fc50ac76f93ca87d94490d53e3b367401df7b Package is runs an Infostealer targeting telegram and Discord credentials. Depending on version, the infostealer is either downloaded from an URL or embedded i...

MAL-2025-41666 Malicious code in dsidelib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5bd949196aad0e516b6c21fb6c9fc50ac76f93ca87d94490d53e3b367401df7b Package is runs an Infostealer targeting telegram and Discord credentials. Depending on version, the infostealer is either downloaded from an URL or embedded i...

Malicious code in secmeasure (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security f566db2e1359b455ca36524d9c066854754e71ac92deca9706f69d3d71cc8414 This package installs the SilentSync remote access trojan and allows remote code execution and data exfiltration. Windows machines are...

Malicious code in supersafepackage (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3b979e1e2520c4f9d07507acc8182830203309adcb9932103a475d3e23e0de3f Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

MAL-2025-41770 Malicious code in supersafepackage (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3b979e1e2520c4f9d07507acc8182830203309adcb9932103a475d3e23e0de3f Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in bh-usa-req-ase (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8c83e1a14cfb125b4cfcb3e1ca52afd31fb170b78ade2aa3fd31cc846b8ac7da If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens --- Category: MALICIOUS - The campaign has...

Malicious code in bh-usa-automate-req-ase (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b0340aadb507418f2d21cfa7d568f133db23a6392a2ec64411540ec4ce5456d7 If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens --- Category: MALICIOUS - The campaign has...

Malicious code in tsesyx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7c8ea2b8c69693d4bd40c7c4b952878565e3bfaa6eb0ea02ab6ef9ca18eadea8 When imported, the package attempts to exfiltrate environment variables and basic user info --- Category: MALICIOUS - The campaign has clearly malicious intent...

MAL-2025-41790 Malicious code in tsesyx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7c8ea2b8c69693d4bd40c7c4b952878565e3bfaa6eb0ea02ab6ef9ca18eadea8 When imported, the package attempts to exfiltrate environment variables and basic user info --- Category: MALICIOUS - The campaign has clearly malicious intent...

Malicious code in web3dummycti (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9a702a53b1f08d4ee8e06e9dc19f6c942ee7bd755274f898a2ff737796557316 If the method from the module is called, it attempts to download a malicious code identified as msf payload and save it locally. In the analysed version, the...

MAL-2025-191928 Malicious code in web3dummycti (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9a702a53b1f08d4ee8e06e9dc19f6c942ee7bd755274f898a2ff737796557316 If the method from the module is called, it attempts to download a malicious code identified as msf payload and save it locally. In the analysed version, the...

Malicious code in req-ase-automate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 be0304806895d9de6cc08d6e969b20baa9be9a8fb1aae813254eb58de6b7212c If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens --- Category: MALICIOUS - The campaign has...

MAL-2025-191854 Malicious code in req-ase-automate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 be0304806895d9de6cc08d6e969b20baa9be9a8fb1aae813254eb58de6b7212c If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens --- Category: MALICIOUS - The campaign has...

MAL-2025-191855 Malicious code in req-pre-automate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6ce39a0e7a45f8d70e0e7e0d0e597b5029dcfcdd422ec0fec324921c5021a9ca If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens --- Category: MALICIOUS - The campaign has...

Malicious code in req-pre-automate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6ce39a0e7a45f8d70e0e7e0d0e597b5029dcfcdd422ec0fec324921c5021a9ca If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens --- Category: MALICIOUS - The campaign has...