Malicious code in legendevil1 (PyPI)

Source: kam193 3188a850ecb974606264f28634afaca67ec2f49c1c759cf590aa39ba19e50452 Package is designed to download and execute a remote script, which then downloads and runs a malicious executable --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in kraken-trader (PyPI)

Source: kam193 4bf5ec6e8a6020de1e122cf07f2dde0f02fa1a484ff984586db379729da75523 The package is a loader of malicious code disguised as remote "credits" code. The remote location, built from the parts in the code, delivers highly obfuscated JavaScript code that could be executed by the node.js...

Malicious code in kcvlib (PyPI)

Source: kam193 4a441a8e0abdd54964ca9e0a5e3a1d0e0c0435f05d80ab9e9210e10194a16f3d During import, the package downloads and executes obfuscated code. It appears to be an infostealer framework --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in just4testlm (PyPI)

Source: kam193 5aed012f2ecc4af261bb7f2fc294b9aee5c0733ccf207b9e9e9a381d51387811 The package likely tests different malicious techniques and delivering payload in setup.py. Different versions, like 0.1.0, 0.4.0 or 0.9.0 contain malicious payload in setup.py that either run remote script or...

Malicious code in justanything (PyPI)

Source: kam193 206471fdab67d7afeeb5fa6ee55cdb14b88338b58b50a5b73f31bbbb5e66e65b Code is designed to download and run remote scripts during installation, which finally downloads and starts an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in jsonschemex (PyPI)

Source: kam193 21f678f82847db32c68ab5a95a827f755d13b5d4cd371667eb584f25ed28ed01 Malicious clone of a legitimate package with hidden code that downloads the next stage scripts. Analysed payloads had just exfiltrated basic infos --- Category: MALICIOUS - The campaign has clearly malicious intent,...

Malicious code in jsonschema-viewer (PyPI)

Source: amazon-inspector 3692022b4caf5ac51d868aaae58e793520ac3bd36703841eb615942baf85bb87 The package's only function — main in src/jsonschemaviewer/main.py, registered as the jsonschema-viewer console script — invokes os.system to fetch a shell script from http://49.232.169.67:8084/slt via curl ...

Malicious code in joyboyw (PyPI)

Source: kam193 36ac711534f46e41704c145912a7a6c3a51f64bb1888469e0730768e00865242 Contains a function to silently download malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-joyboyw Reasons based on the campaign: - Downloads and execute...

Malicious code in jsonist (PyPI)

Source: kam193 4c74a199a696dbc18994242bc3c29e9a018ddda51fa2bbe224620d9ded6f1818 Calling a method starts downloading and starting an infostealer script --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-08-secmeasure Reasons based on the campaign...

Malicious code in javascan (PyPI)

Source: kam193 3b87a6ab9caea125ba4a71189d6a1740668e44d637f7e7c2d4f85daaf4f54ed0 During installation, a code is downloaded and executed. This remote script then attempts to exfiltrate environmental variables, SSH keys, Slack secrets etc. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in httpx-client (PyPI)

Source: kam193 d26dbf9fa1035b8b1e189f67123ee22f506cd21c08e17c282176a716af9da033 Importing the module starts downloading and executing first a script, and then a widely identified malware Packages are used as dependencies in a GitHub project https://github.com/ToolParadiseDrako/Nuker-Tool-Paradise...

Malicious code in httpfluent (PyPI)

Source: kam193 ad45caa6ad5e9c6f356193dc378e801a9fd3846f04443ad9d6c841b0b2e80c62 The package contains highly obfuscated content, that install another, downloaded from a remote location obfuscated script in the installation path of the 'requests' package, and marks it as a hidden system file. In...

Malicious code in helu (PyPI)

Source: kam193 15a97c1f0e23d838c86d69a3ceae306071a9b4b8c17162a1f563aefe489ffbe4 During import, the hidden code downloads and executes the second-stage code. After performing anti-analysis checks, it downloads a malicious executable and ensures its persistence. --- Category: MALICIOUS - The campai...

Malicious code in haqawi (PyPI)

Source: kam193 6c55dd7769c6bf39fd838af80c68669f79339abce1333cd421d9477144d7fde4 Package is designed to download and execute a remote script, which then downloads and runs a malicious executable --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in hangimani (PyPI)

Source: kam193 4eb1b67eac28a42f372ecaaca274a28d15972e3cc8e063492f977364538e6c41 During importing the module, package downloads a second-stage code from GitHub, which then runs an infostealer. After that, the downloaded code is removed --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in hancsv (PyPI)

Source: kam193 bb3fdca931bea8323cd7a8c2578f6d0c0594b3ea1b30df1819830168fe90983b Importing the module triggers downloading and executing Powershell script. The script collects information about the host including e.g. startup applications and also downloads the next stage executable. While the...

Malicious code in graphdict (PyPI)

Source: kam193 d6536224bd962025c65671a0007df1998dbc9485dfb2d628b0a0d57ab916487e Malicious clone of legitimate networkx package with added hidden encrypted code. The exact behaviour unclear as it uses decryption key based on the arguments and config files --- Category: MALICIOUS - The campaign has...

Malicious code in graphsync (PyPI)

Source: kam193 dbb10327d6553750848c2b849abba1ed717438928a6cfdc148b73de73db8e9db This is a malicious copy of the networkx package. It contains an obfuscated script that downloads and runs further scripts from one of multiple locations, and perform covering tracks by removing the modified code and...

Malicious code in graphnode (PyPI)

Source: kam193 981903800087e4528bba3ec6bb841e810feaedfa490e7f078fcac9c9d663e4ce This is a malicious copy of the networkx package. It contains an obfuscated script that downloads and runs further scripts from one of multiple locations, and perform covering tracks by removing the modified code and...

Malicious code in formater (PyPI)

Source: kam193 71f6a751b5ff98dceeee5863086a2d9988640b93d96ccef9d50fb0d0d1dd116c During importing the package automatically downloads a script that uses a Telegram bot to perform remote control over the computer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...