Malicious code in graphicsx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3f85a722af04dc8f110fe530c6c3de3345ac2cf99b4e315d82cbbf0039c54660 Installing the package starts downloading and installing an Infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in dbsxrchpro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f7e904380115b3ea3cfb5766a5e527bb71775c65af3706c2d5392ef3e60d17c5 Installing the package starts downloading and installing an Infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in flamepro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 53c4ea20a42b8ba4c81e1625a540dbe1eff5fde676d280fb1b1a53d04b7ef069 Installing the package starts downloading and installing an Infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-2955 Malicious code in dbsxrchpro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f7e904380115b3ea3cfb5766a5e527bb71775c65af3706c2d5392ef3e60d17c5 Installing the package starts downloading and installing an Infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-936 Malicious code in intgraphx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4fb1e216d0815e75bd49620f6176c757576a58b8e4669df0ff803d7a84aad2ba Installing the package starts downloading and installing an Infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in bancor-simulation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8e9ecf6b613a42c070932a842fc4ebe81508d28adbb0aecee9aebe4e530acc0a The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

Malicious code in crowdstrike-foundry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 89a436ce955b3eb01df1e23a27f7b9d0091b3720818f31559038c7af44bca276 The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

Malicious code in foop (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8dd063ab676114f4458052dd442285fb78dace9c91fd0b810c5c137cf3a4cb44 The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

Malicious code in auth0-open-source-template (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c14dd94f3cdea34f9073f26be0716cfd944e0362396ae1dccab12196021a328c The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-927 Malicious code in foop (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8dd063ab676114f4458052dd442285fb78dace9c91fd0b810c5c137cf3a4cb44 The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

Malicious code in calccc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 66371c79f4cedb638d8d283883415c46a4bf6be25e3699fe5229bc8cd71a2f0a Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

Malicious code in christmasmiraclemaker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 64f06a86dd5b916af92fc3adf5c1e5638df9eaa156a1bc122e4e647f2aae236e Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

MAL-2024-12215 Malicious code in bestcolorsever (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8335ea2981241d7eb1836338e2a942abf4f5096eb264b0ceb13e85ec435b6465 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

MAL-2024-12314 Malicious code in nirohf-reverse-shell (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c2b0a9ce248bca096b5109a73b943559cabbd6f77433d4a64cd1c804f7ec88df Installing starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in kotlin-stdlib-jdk8 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f217cf2fd34c9cab642b70bd9d778e6ef08a3dfba1954060a29983f2d3e6d47e Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2025-905 Malicious code in byted-df (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 821138aac758315c7a31a463523c4930bdd52e67699199e4c8bda0511c5907f8 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2025-985 Malicious code in shoots-api-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78ebd73df4ce754b9e3a33af932d2b686a05716f83ccf3d7dd99029e73713acc Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

Malicious code in shoots-api-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78ebd73df4ce754b9e3a33af932d2b686a05716f83ccf3d7dd99029e73713acc Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2024-12231 Malicious code in ccsinstaller (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3e18cda71c2919c802b866f37fc87002396540fd6d3ea3f22b7703111c247518 Installing package downloads and install an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

PyPI Python Library "aiocpa" Found Exfiltrating Crypto Keys via Telegram Bot

The administrators of the Python Package Index PyPI repository have quarantined the package "aiocpa " following a new update that included malicious code to exfiltrate private keys via Telegram. The package in question is described as a synchronous and asynchronous Crypto Pay API client. The...