Malicious code in jie-utility-package (PyPI)

Source: kam193 2cab7c48587f060014e5c8453f9ab21c0e6dd3c3523d095c1fcafbce8cbee2d1 During installation, the package attempts to create a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-04-my-package-jiecub3 Reasons based on the...

Malicious code in iscc-flag (PyPI)

Source: kam193 cb80cd1cd16dd0ba2beb2e560000380b1eb3cb60d947ed49d5ce9bfb4b12008f Installing starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-anku2-rce Reasons based on the campaign: - The package contains code to creat...

Malicious code in innostage-group (PyPI)

The package contains code to download and execute a reverse shell script. Source: kam193 9d0f2f6104de4772268a20f51e009797c0c4b0740d18d98d730417fdafdfb052 When imported, the package download and runs a remote stage - a reverse shell. To mask activity, the remote domain is made to mimic PyPI host:...

Malicious code in innostage (PyPI)

The package contains code to download and execute a reverse shell script. Source: kam193 ec433c9a241ed7127dc5d6f55b002e94a2407ddd47000e50355f118536e9021e When imported, the package download and runs a remote stage - a reverse shell. To mask activity, the remote domain is made to mimic PyPI host:...

Malicious code in improvado-layout-panel-metrics (PyPI)

Source: amazon-inspector 61cc6b0b5d5efe4675f4159e8bc8f6380970614c1dc36b553207fa73fa66104e The package's top-level fluentpanelmetrics/init.py defines bootstrapruntimeprofile and unconditionally invokes it at import. The function opens a TCP socket to 34.69.137.236 on port 80 falling back to 443,...

Malicious code in hkmat (PyPI)

Source: kam193 c3c3063747c35c5ae091331ac2c35dbef66c945aca73b06ee32ef1f0ec088009 Importing the module starts a telegram bot that connects to a chat and executes provided commands --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-talbat Reason...

Malicious code in hellohackers (PyPI)

Source: kam193 63788f1f3223270be7955b619eb09fa7e7f401084e4332ed732d33b522782a37 File contains a metapreter beacon that runs in the setup.py. Analysed version uses a local IP as the target. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in hello-test-s1 (PyPI)

Source: amazon-inspector e168a49ebd07050fbf35d1cd9714b289903c0593b9bdef27874f975be60461b7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193 3e38aef2a7eaa434284aa00122cf429e1a1a07658e02afec7bb3690d7cbfe9ec During installation or...

Malicious code in hekamhelp (PyPI)

Source: kam193 ac329f6244d2faf82ef12a167d1b46de2a9043fb1c086b67a45458d75d227562 Importing the module starts a telegram bot that connects to a chat and executes provided commands --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-talbat Reason...

Malicious code in genz-translator (PyPI)

Source: kam193 983b5b328e433d81113b3e170f313aba83ae5eff0ecd515fc9865ca3a5be1ee9 Installing the package installs a reverse shell. As the mentioned domain doesn't seem to exist, it may be a test designed for an internal usage --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in gemini-analyzer (PyPI)

Source: kam193 1c8996b17229185440fe7523f20f72ea848f3a001baa8946ca80fa6b5d3221ad The package is a RAT performing full exfiltration and executing remote commands through a custom RPC protocol over WebSockets, and eventually establishing a reverse shell. --- Category: MALICIOUS - The campaign has...

Malicious code in free-internet-dns (PyPI)

Source: kam193 80f5bbcb50f9c9699a083711bb4d59905b49a198ddcd8c95425030d01d6a45e5 Installing the package installs a backdoor a qsocket.io and automatically uploads access credentials from the output of the qsocket client to the remote server. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in fluent-panel-metrics (PyPI)

Source: amazon-inspector 95598f66d3e0a4ecbfe9dcd01c1d5f0be9b78bee23b200758a92dac8f8a00d9e fluentpanelmetrics/init.py defines bootstrapruntimeprofile and invokes it unconditionally at module load. The function opens a TCP socket to the hardcoded IP 34.69.137.236 on port 443 with fallback to port 8...

Malicious code in fluent-dashboard-panel-metrics (PyPI)

Source: amazon-inspector 9e745c609fb43daaa93911ae2edcb05b1ffd3cec1c6ec55c321597e9e39eb153 fluentpanelmetrics/init.py defines an undocumented function bootstrapruntimeprofile and invokes it unconditionally at module top level. The function opens a TCP socket to 34.69.137.236 on port 80/443,...

Malicious code in flask-auth-sys (PyPI)

Source: kam193 a241889bfae20aee5395660063d13f337aa9733c14b02bf2edb004d6d36e1d41 On importing the module, the code attempts to span a reverse shell. In the current version, the remote domain does not exist --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in flask-auth-system (PyPI)

Source: kam193 debc87eb7af33e5146831c7e1b8ff69ccdebe2c9bbf353216c719b10ebe8431c On importing the module, the code attempts to span a reverse shell. In the current version, the remote domain does not exist --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in evil-rce2 (PyPI)

Source: kam193 63a6a4d1f5ad55b3b2b836b95a7153f322bb4ea2f718f665a51a4a94f32576d5 Running the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-12-evil-rce Reasons based on the campaign: - The package contains code t...

Malicious code in evil-py-argo-shell (PyPI)

Source: kam193 1739dfc040a7678b086f2ca5bab22249fcea3774fbf83c70a40b6427d6a847ee Package demonstrate potentially malicious execution of system commands, and seems to be used for pentesting purposes --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything th...

Malicious code in evil-rce (PyPI)

Source: kam193 74a74a4133ed8082eba8452bb59a82dcf6975e1e8c4d6630a47088c17d6b6cca Running the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-12-evil-rce Reasons based on the campaign: - The package contains code t...

Malicious code in enquiry-exam (PyPI)

Source: kam193 590114fe4174abb1ff72c06bf128aef53bd76a67eaeca5d5e891be001f6b0c17 Package contains a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-03-certifications Reasons based on the campaign: - The package contains code to...