Malicious code in python-dev-toolkit (PyPI)

Source: kam193 3e8bbf18a10505977ab19adc6dd13d15e1c7df3c69391e1c930289b953619549 Installing packages exfiltrates data different in different packages and versions or run revshells --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in python-datetil (PyPI)

Source: kam193 ade289b57baa6b63431a9653e51023f1e631fbc0e36471acdb51c821410ea8dc Package consist of a revshell only. The effective danger is low as it's clearly designed to connect to a localhost only and be used as awareness. --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

Malicious code in python-dateitil (PyPI)

Source: kam193 f7d09226c2d76a03909b10c844a44149abf2606a5f1f55232ee7620580835787 Package consist of a revshell only. The effective danger is low as it's clearly designed to connect to a localhost only and be used as awareness. --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

Malicious code in proxy-check-ii (PyPI)

Source: amazon-inspector a736498f3f882a4ba79f793dc893883db41d8cb5a74ecfe0c66dace9cc477a20 The wheel is advertised as 'proxy-check-ii' with a one-line summary of 'packaged command for running the bundled qsshd executable' and no README, homepage, source, or author metadata. It installs a 7.7MB...

Malicious code in proxy-checker-j (PyPI)

Source: amazon-inspector 4316f8f54acc92939cdf73074666eecab7d5e680c7c4ad572ad3164671aa19dc The package is published on PyPI as proxy-checker-j with the summary 'packaged command for running the bundled qsshd executable', but its actual payload is a Go SSH daemon qsshd that opens persistent remote...

Malicious code in ptsecurity (PyPI)

The package contains code to download and execute a reverse shell script. Source: kam193 a67d1a04a247e897d3da239f3ff95a95284282eb6bb38c266273167e4419b9c1 When imported, the package download and runs a remote stage - a reverse shell. To mask activity, the remote domain is made to mimic PyPI host:...

Malicious code in proxy-check-i (PyPI)

Source: amazon-inspector 2da390c130eb840eb129a5d43faf0a64a0f0f602070243613aa0e2f8ea8f6d04 The package advertises itself as a wrapper for a 'qsshd executable' but the bundled Go binary is a reverse-SSH daemon that grants a remote operator persistent shell, exec, pty, and TCP port-forwarding on the...

Malicious code in posi (PyPI)

The package contains code to download and execute a reverse shell script. Source: kam193 9eff1140edfe020fe3ef5905579f5e5d74a8cd0638332576041513ce894eb27e When imported, the package download and runs a remote stage - a reverse shell. To mask activity, the remote domain is made to mimic PyPI host:...

Malicious code in pipinpeace-reverse (PyPI)

Source: kam193 471ba9f8dde66035e8bff446fc8acb160f041648a1fc47dd3f00db6e2ea58d08 Package is designed to start a reverse shell during installation. However, it requires providing a URL as an installation parameter, which suggests it's more research than direct malicious intentions. --- Category:...

Malicious code in pipinpeace-bind (PyPI)

Source: kam193 e78be1bf65bda1455a5f08dafdf69aef528e4fb206333e1ecb6c6a97fe8adbc2 Package is designed to start a bind shell during installation. However, it requires providing the port as an installation parameter, which suggests it's more research than direct malicious intentions. --- Category:...

Malicious code in pam98wyfupa98w (PyPI)

Source: kam193 be7177fd2d56b518724377233ca5eda13a07f6252e400cfb4c1115db456b5fd8 Importing the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-d1n0 Reasons based on the campaign: - The package contains code to...

Malicious code in northstart-sdk (PyPI)

Source: amazon-inspector aa58bcfb4f89faf624c1f99bb552e597cc2e061330a2e98e72e6f401bb70b4f9 The pypi package northstart-sdk 0.2.1 executes attacker-controlled code as a side effect of import northstartsdk. The top-level init.py assigns AUTODEMORESULTS = runbundledencrypteddemos, which fetches 8 byt...

Malicious code in nirohf-reverse-shell (PyPI)

Source: kam193 c2b0a9ce248bca096b5109a73b943559cabbd6f77433d4a64cd1c804f7ec88df Installing starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2023-12-09-nirohf-reverse-shell Reasons based on the campaign: - The package contains...

Malicious code in my-package-jiecub3 (PyPI)

Source: kam193 1ec43b076f10c0f300bdde6c106bc020894f238b7b2b72e3a3c146d189bdb3a4 During installation, the package attempts to create a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-04-my-package-jiecub3 Reasons based on the...

Malicious code in mymaldependency (PyPI)

Source: amazon-inspector 38372ffa2ec19cee68f769508d95ffb4f5c1878aeae058ce3e7a33b947d06cf1 MyMalDependencypackage/init.py executes on every import: it calls os.uname and os.getcwd, writes the results to./trans.txt in the installer's working directory, then invokes os.system'scp trans.txt...

Malicious code in myasicapi (PyPI)

Source: kam193 62067570b5217e75a025ba09e5e4f0d059439d8a7d30e056bdd501fe97e4f844 The code and related Github project promise to monitor hardware cryptominers. However, the code additionally hides two malicious capabilities functionalities: 1. acting as an attacker-controller proxy, 2. reversed she...

Malicious code in my-test-package-2025-xyz (PyPI)

Source: kam193 a2f3ab0a3c7ef9009c99575d9dd051c4a97575435cabf5d3a4c223f53bc47b89 During installation, the package opens a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-05-my-test-package-2025-xyz Reasons based on the campaign: ...

Malicious code in moonbit-locale-compat (PyPI)

Source: kam193 d42bb32adb1fb5f388368b9e4ab382bfbc8cd7f62dab4c70a8563a448ce9c2af Campaign includes a chain of dependencies that finally exfiltrate sensitive environment variables to a hardcoded GitHub repository as exfiltration target, and in specific environments also start a reverse shell. It...

Malicious code in moonbit-metrics-validator (PyPI)

Source: kam193 e6bb44c25db578131ec69b1c961c22f67cabb0b81aae5fe9d4620194bf8d83cc Campaign includes a chain of dependencies that finally exfiltrate sensitive environment variables to a hardcoded GitHub repository as exfiltration target, and in specific environments also start a reverse shell. It...

Malicious code in moonbit-schema-utils (PyPI)

Source: kam193 5fd7cc9fd6247802480f37b02a23faadb37c7fa5aded77358015c0861ab980e7 Campaign includes a chain of dependencies that finally exfiltrate sensitive environment variables to a hardcoded GitHub repository as exfiltration target, and in specific environments also start a reverse shell. It...