MAL-2025-191653 Malicious code in ptxcompiler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a157c2b8ad78e45eea0b8e20ef6d466cdefbd686ac62041c13580048283ba7a1 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in poc-suppentest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 34829d348b54453367c47f9936c2ea6953832cbf8396649c1d79813aabb93f4e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-191652 Malicious code in poc-suppentest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 34829d348b54453367c47f9936c2ea6953832cbf8396649c1d79813aabb93f4e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in egarcia-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f9528d01cc9eb845439565bd5b1446d74daa6a6ae76cd4acc3ffae124b2e0cb4 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-191623 Malicious code in egarcia-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f9528d01cc9eb845439565bd5b1446d74daa6a6ae76cd4acc3ffae124b2e0cb4 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in makronlox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f918d3ae448737e8a58e16ad57af3037e27ba8ab02fef22ba6e0b4f6f2c49e1a Package automatically download and runs an executable, which then imitates a malicious action and requests ransom payment. --- Category: MALICIOUS - The campai...

MAL-2025-191646 Malicious code in makronlox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f918d3ae448737e8a58e16ad57af3037e27ba8ab02fef22ba6e0b4f6f2c49e1a Package automatically download and runs an executable, which then imitates a malicious action and requests ransom payment. --- Category: MALICIOUS - The campai...

Malicious code in musl-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 921a96dbb105de30a891a3770c85b1a240ad3625bb52b4e6276340c641b4a46f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-191650 Malicious code in musl-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 921a96dbb105de30a891a3770c85b1a240ad3625bb52b4e6276340c641b4a46f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-191862 Malicious code in saintone (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d762a42d55901a472c7070197cef989428ecb0140acfe02c72d719d74b430436 Code downloads and starts an executable widely recognized as malware, then sends some results to a Telegram webhook. --- Category: MALICIOUS - The campaign has...

Malicious code in md5-en (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1c7608df27812e170abf1fa650287b87174700cd5a23658ae8d81317f7cd93dc Code downloads and starts an executable widely recognized as malware, then sends some results to a Telegram webhook. --- Category: MALICIOUS - The campaign has...

MAL-2025-191649 Malicious code in md5-en (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1c7608df27812e170abf1fa650287b87174700cd5a23658ae8d81317f7cd93dc Code downloads and starts an executable widely recognized as malware, then sends some results to a Telegram webhook. --- Category: MALICIOUS - The campaign has...

Malicious code in tosa-serialization-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5badd7c7414eb1f6fbdf1934b42ffe74549daa74508afd092af853097170eb8e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-191908 Malicious code in tosa-serialization-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5badd7c7414eb1f6fbdf1934b42ffe74549daa74508afd092af853097170eb8e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

npm, PyPI, and RubyGems Packages Found Sending Developer Data to Discord Channels

Cybersecurity researchers have identified several malicious packages across npm, Python, and Ruby ecosystems that leverage Discord as a command-and-control C2 channel to transmit stolen data to actor-controlled webhooks. Webhooks on Discord are a way to post messages to channels in the platform...

Malicious code in mcp-runcmd-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2e5608c421ba44a3a2e20b924bd3399d6452dba66e7aea10a0fcdc8044f5a996 Package starts a reverse shell to a hardcoded location --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2025-191788 Malicious code in mcp-runcmd-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2e5608c421ba44a3a2e20b924bd3399d6452dba66e7aea10a0fcdc8044f5a996 Package starts a reverse shell to a hardcoded location --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in hexdec (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b35c77c73cb594ed27985ac5e797ed54657a3301e976728e8fdf06dedb94e085 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2025-191629 Malicious code in hexdec (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b35c77c73cb594ed27985ac5e797ed54657a3301e976728e8fdf06dedb94e085 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in python3-6 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d48e27507362baa15b8e41d1554bce82077fcc870112ab6cb4d17694b47c8ef3 During installation, the obfuscated code is run and connect with a remote server. In the current version, the code just opens a URL without exfiltrating any...