Malicious code in enquiry-exam (PyPI)

Source: kam193 590114fe4174abb1ff72c06bf128aef53bd76a67eaeca5d5e891be001f6b0c17 Package contains a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-03-certifications Reasons based on the campaign: - The package contains code to...

Malicious code in dns-execution-test (PyPI)

Source: kam193 4fc1fd65caa9c7f199fba16c9d3772c7db895ed78b29130a7ddc3347a4b34ba7 Installing the package starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-02-dns-execution-test Reasons based on the campaign: - The package...

Malicious code in donotinstall (PyPI)

Source: kam193 a0c56680f6f4db81ec1ad0691253d592055a3581b00e9c93e3dfd6d448b63212 Package contains obfuscated reverse shell. However, it connects with a local IP only, thus it's much more a test than a malicious action --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages,...

Malicious code in dftester-pip (PyPI)

Source: kam193 2e23c327cc9243e5437e6b31224c6796b90399065b451269641911b1d1982483 Example package with overwritten install command and the reverse shell --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared...

Malicious code in dash-grid-normalizer (PyPI)

Source: amazon-inspector 362011eafffa765e7f6c24df4ec2c7bb8f9fb6b6414570a5d193e6ea90e1250a On import, src/dashgridnormalizer/init.py calls hydrateremotelayoutprofile, which reassembles a payload from four string segments, base64-decodes and zlib-decompresses it, and passes the result to...

Malicious code in data-processing-utils (PyPI)

Source: kam193 f5c7542831f6f9fe72a65e436b1f85c10261aac12ceae6f1bcc490afad6d1aaa Installing packages exfiltrates data different in different packages and versions or run revshells --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in darkglitch (PyPI)

Source: amazon-inspector 6d02eb8be388433532783a7bf88864824b50756b7ced4f8728721866740c5df1 darkglitch 1.2.0 ships a listener mode -l -c that opens a WebSocket connection to the hardcoded signaling host https://malware-signal.vercel.app/ and joins the fixed room D4RKGLI7CH. Incoming remote-command...

Malicious code in d1n0-exploit-aaaa (PyPI)

Source: kam193 64210508ed5694fbb8abfa75dbca12a3f6a0ebc0b653866d6fd01de23cdc5170 Importing the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-d1n0 Reasons based on the campaign: - The package contains code to...

Malicious code in d1n0exploitaaaa (PyPI)

Source: kam193 7ecd01d9010a3e9192c6636d4ddefa1e493438b1bbf65002e8daf6a014067692 Importing the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-d1n0 Reasons based on the campaign: - The package contains code to...

Malicious code in cyberart (PyPI)

The package contains code to download and execute a reverse shell script. Source: kam193 a56fce758142261d4c665b192e7f292a8b9c89a750be3271fc2e1c784d886828 When imported, the package download and runs a remote stage - a reverse shell. To mask activity, the remote domain is made to mimic PyPI host:...

Malicious code in cti-ctf-challenges (PyPI)

Source: kam193 1cefe6c8a9ac6ede7c6ba497cf17011bf431812980749bb0068995ebba4039d9 If the method from the module is called, it attempts to download a malicious code identified as msf payload and save it locally. In the analysed version, the code starting the malicious code was commented out. ---...

Malicious code in ctf-aio-tool (PyPI)

Source: kam193 1641f444ea0056686d1421b67d63c1a6fd944999ed4dff175924de88f1d5182a Installing the package starts a reverse shell. The remote server is, however, set as a local IP, so it's most probably testing --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...

Malicious code in cobo-python (PyPI)

Source: kam193 2f1c1c4efd134e130c04178382ff3ea318301fb18b5eb6eed696c49cf64e9ad6 It appears to be a forgotten pentest checking typosquatting against cobo-custody package, but may also have malicious purposes. During installation, if a machine is Mac, an obfuscated code attempts to download and...

Malicious code in cobo-custdoy (PyPI)

Source: kam193 1bb6da528665b6d869e583cb594f1f0cc7e7ccaf8cc5a7a859c0db9e7fa80c19 It appears to be a forgotten pentest checking typosquatting against cobo-custody package, but may also have malicious purposes. During installation, if a machine is Mac, an obfuscated code attempts to download and...

Malicious code in cobo-custdy (PyPI)

Source: kam193 cd0d754c7d09b395a490411bfdba9006309e5227c634e9946f4612de907de0d0 It appears to be a forgotten pentest checking typosquatting against cobo-custody package, but may also have malicious purposes. During installation, if a machine is Mac, an obfuscated code attempts to download and...

Malicious code in chatgpt4 (PyPI)

Source: kam193 6a2f99d20569358bdeab51db7e4f6ea0348c87bbf832a7bc244581a472a05072 Importing the module starts shell code execution --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-06-chatgpt4 Reasons based on the campaign: - impersonation -...

Malicious code in cicibot-fix-message-naming (PyPI)

Source: kam193 7fb20d1d9da8ede0270346034bb6fdca56ef578e35a73b4cb0301664ab4a27ab Importing the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-02-cicibot-fix-message-naming Reasons based on the campaign: - The...

Malicious code in certifications (PyPI)

Source: kam193 7d51c9defecdd382c5048eb6f92b32558355b8457b2b5cd63f3d86e12e8ed35b Package contains a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-03-certifications Reasons based on the campaign: - The package contains code to...

Malicious code in calculator-c08d6d50f5964131 (PyPI)

Source: kam193 6343baa8b5e97a91b02979723f28035221550addc225d0e3911916a51ef5ef37 Clearly research/pentesting examples containing reverse shell. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits,...

Malicious code in buffparser (PyPI)

Source: kam193 5cc891132b1216e9093bcdd4581373dc7f750f700c82347c28bd1dff079261d8 Described as a utility for gaming, the code starts a reverse shell when using the exposed alledegdly parsing function. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...