PyPI Attack: ChatGPT, Claude Impersonators Deliver JarkaStealer via Python Libraries

Cybersecurity researchers have discovered two malicious packages uploaded to the Python Package Index PyPI repository that impersonated popular artificial intelligence AI models like OpenAI ChatGPT and Anthropic Claude to deliver an information stealer called JarkaStealer. The packages, named...

Malicious code in blackamerxs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 50486a7fa5636706a3c90bf515f6664c6cbb11aa127f9b3e95d7b38cf89c80c8 If run, the code in the package exfiltrates all files from the current directory tree. --- Category: MALICIOUS - The campaign has clearly malicious intent, lik...

acia (>=0.3.0, <=0.4.0), ai-parrot (>=0.22.0, <=0.24.0) +239 more potentially affected by CVE-2024-30896 via influxdb-client (>=1.3.0, <=1.50.0)

influxdb-client PYPI version =1.3.0, =0.3.0, =0.22.0, =0.0.7, =1.0.0rc1, =0.1.0, =1.0.8, =0.0.1, =0.1.6, =0.1.0a1, =1.0.37, =0.1.0, =0.5.0, =0.12.0, =1.6.0b0, =1.14.1 and more Source cves: CVE-2024-30896 Source advisory: SNYK:PYTHON-INFLUXDBCLIENT-8422793...

Pyload Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/stopwatch' class MetasploitModule 'Pyload RCE CVE-2024-39205 with js2py sandbox escape CVE-2024-28397', 'Description' = %q CVE-2024-28397 is sandbox escape ...

Malicious code in random-security-test-pkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8d5e8dadc66c780e3fc3351cf55a305fe623b46a48e96847a7da95ea0e5ec211 During installation, the obfuscated code attempts to exfiltrate basic information about the host. There is no other purpose of the package --- Category:...

MAL-2024-12291 Malicious code in instacart-roulette-daemon-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a3b808e86bd3e62945973ac3b25e0f07437a3031a13b6dd2a0567eba90a63821 During installation, the obfuscated code attempts to exfiltrate basic information about the host. There is no other purpose of the package --- Category:...

Malicious code in zebo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 27f62f0f9a2a11b03c5bbead202d9f5d58ca471041e3115eb67dd88accc22be4 Package automatically installs a script with keylogger and screenshots extraction, and sets it for an autostart. --- Category: MALICIOUS - The campaign has...

MAL-2024-11751 Malicious code in zebo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 27f62f0f9a2a11b03c5bbead202d9f5d58ca471041e3115eb67dd88accc22be4 Package automatically installs a script with keylogger and screenshots extraction, and sets it for an autostart. --- Category: MALICIOUS - The campaign has...

MAL-2024-11668 Malicious code in pycalculater (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 84e239de4d2d6d9652a78ead4c1ebb6b3f4952aeb54dc51dc30765eaaf806368 During installation, a remote, obfuscated executable is downloaded and started. The executable at least disables automated updates, malware protection and othe...

Malicious code in discconnect (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd96a216a1790b73568af638b97003c7abd1f502c962137cd1084fb48ebcca64 During installation, a remote, obfuscated executable is downloaded and started. The executable at least disables automated updates, malware protection and othe...

Malicious code in pycalculater (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 84e239de4d2d6d9652a78ead4c1ebb6b3f4952aeb54dc51dc30765eaaf806368 During installation, a remote, obfuscated executable is downloaded and started. The executable at least disables automated updates, malware protection and othe...

MAL-2024-11576 Malicious code in discconnect (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd96a216a1790b73568af638b97003c7abd1f502c962137cd1084fb48ebcca64 During installation, a remote, obfuscated executable is downloaded and started. The executable at least disables automated updates, malware protection and othe...

Malicious code in reverse4343 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a90c21a3dc6b4091f1ccd6f17c99b1ec955954d2b78e93029e63c33f12ed3c7d The package contains only a reverse shell started on installation --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in reverse434343 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9107d563a329f12fdff39bb22f6d6593f6d005d38f9738c2d3a78c94ee368262 The package contains only a reverse shell started on installation --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2024-11694 Malicious code in reverse434343 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9107d563a329f12fdff39bb22f6d6593f6d005d38f9738c2d3a78c94ee368262 The package contains only a reverse shell started on installation --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in eosio-signer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 647b75de784ff7b23edb8a5b76d1a017b02d1fd719c6a5a92587fa8d89c25abf Installing the package exfiltrates basic data about the system --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anythin...

MAL-2024-11582 Malicious code in eosio-signer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 647b75de784ff7b23edb8a5b76d1a017b02d1fd719c6a5a92587fa8d89c25abf Installing the package exfiltrates basic data about the system --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anythin...

Fedora 41 : python3.13 (2024-9fe1974c0f)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-9fe1974c0f advisory. Automatic update for python3.13-3.13.0rc1-2.fc41. Changelog Tue Aug 6 2024 Miro Hronok - 3.13.0rc1-2 - Fix SystemError in PyEvalGetLocals - Fixes: rhbz230310...

Fedora 37 : python3.9 (2022-028c09eaa7)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-028c09eaa7 advisory. Security fix for CVE-2022-42919 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Fedora 37 : python3.10 (2022-dab4c0bcb5)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-dab4c0bcb5 advisory. Automatic update for python3.10-3.10.5-2.fc37. Changelog Thu Jun 9 2022 Charalampos Stratakis - 3.10.5-2 - Security fix for CVE-2015-20107 Resolves:...