Malicious code in pipmodule823 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 57b078ffca6f219848df2289282933442be06a2932d0d163ede59fe4a533faca If run as a module, the package downloads and executes a remote script. At the time of check, the remote script was just opening a popup; thus it's not...

Malicious code in pipmodule83 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 95b01ea01a7fd1ff5e52491e6b143aa98f45a6f331814222fe38e76ad3ac0863 If run as a module, the package downloads and executes a remote script. At the time of check, the remote script was just opening a popup; thus it's not...

Malicious code in malimalo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3b4acdcbd7f8ae1e20019b3c0126a4b5bac73cb07a6bc4c0c3a024bc2a390b34 The only goal of the package is to execute a webhook or a suspicious file during installation. Closely related to 2025-07-0x9xnx - created after previous...

MAL-2025-6542 Malicious code in malimaloo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cfbfc14d4873b047e472e26b760198ecc402eb1ed35d59ab3ace8dc31936690f The only goal of the package is to execute a webhook or a suspicious file during installation. Closely related to 2025-07-0x9xnx - created after previous...

Malicious code in malimaloo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cfbfc14d4873b047e472e26b760198ecc402eb1ed35d59ab3ace8dc31936690f The only goal of the package is to execute a webhook or a suspicious file during installation. Closely related to 2025-07-0x9xnx - created after previous...

Malicious code in malinssx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ec1d3e0940a3c37917b528689547d3728f9f3d0b9e408acc7dcc67435c09d2b0 The only goal of the package is to execute a webhook or a suspicious file during installation. Closely related to 2025-07-0x9xnx - created after previous...

Malicious code in hellotesthim (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a7a4369b02deb0d2a9cf1340be0efe760e29f7979e3f7361ba029a282b70597f Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...

Malicious code in malipkghehe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7d87e6aa802f74ebffe0dd2741a513b40db41629d41828bf5b9847ca87e7609e Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...

MAL-2025-191733 Malicious code in fonafx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9441463f029726ea263225e9b0092d82b049e2d7a4e059becd24f5e23c70a906 Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...

MAL-2025-6544 Malicious code in malipkghehe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7d87e6aa802f74ebffe0dd2741a513b40db41629d41828bf5b9847ca87e7609e Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...

Malicious code in rehttps (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 08172961784989f62b2b0793fa7686e1c25883883f790293df61591aa2fc6940 During installation, package attempts to download and starts an executable. The package itself is a clone of requests --- Category: MALICIOUS - The campaign ha...

Malicious code in walletutility (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b2977792a67d074770c5080ac055addab8c5bf6b77bf203132fb2c67f32091a6 Package silently exfiltrates the provided mnemonic --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in wallet-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c83a3acdf0b02acc2a9af7cf885f2f744a154847edc66e1264ee1c38d8d7b984 Package silently exfiltrates the provided mnemonic --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in walletsdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 24b8f8046f66b9996b1f2169f1034b1c35f0760e09d4e91e712d0b3a36a88d6e Package silently exfiltrates the provided mnemonic --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in walletsutils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 98651db61cea6613aac5b784cf567a82461f39c8cfa2c7634504ea2708989408 Package silently exfiltrates the provided mnemonic --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in utilswallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 587ebf505d5385c1a6f9034ff8ede5f52b9f7f31ad154261c0f5a289af62a33d Package silently exfiltrates the provided mnemonic --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2025-6613 Malicious code in utilswallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 587ebf505d5385c1a6f9034ff8ede5f52b9f7f31ad154261c0f5a289af62a33d Package silently exfiltrates the provided mnemonic --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in cpan (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e70433969aea3c8283f99098b25b8a598f427b5fd451e9bfd5bc46098704bfb2 Installing the package starts a revshell and download and starts a remote script depending on version, different malicious functionality. The name seems to...

Malicious code in managment (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 754c9b609bb8dafc0fd21d141cd216744d9f2aa1f23898990c52e872fdc23e1a Installing the package starts a revshell and download and starts a remote script depending on version, different malicious functionality. The name seems to...

Malicious code in sqiul83 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 67d309c2d4c740426c07cc17768f6313eebd765242e7e4a63aa04213d21358ea During installation of the source package, it attempts to silently download and start a remote executable. At the time of analysis, the downloading link did no...