Malicious code in claudeopusenifile (PyPI)

Source: kam193 051daf7dfb8c28210996afbf561646b38781f563483e6c2e7471add0a6021885 During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data a...

Malicious code in claudeopuseni (PyPI)

Source: kam193 355cfc006ca4cb062c248bf2108be828c6164ae20d12ee5c7794ab68ee351843 During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data a...

Malicious code in claudeopusfile (PyPI)

Source: kam193 9a776d104d66cbeec1283bd7a7e9decc15da19a1946dd27c7d7ca632a6cdc2f2 During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data a...

Malicious code in claudeopuseni (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 715421a3b919f086db6ad4a57d6c8d6d333b019e3a63e607be95cf3fcb7aef5d On import, claudeopuseni/init.py invokes boot.check, which issues an HTTPS GET to https://thisisafalsepositive.st/cdn/v2/claudeopuseni/manifest.json,...

MAL-2026-18299 Malicious code in claudeopuseni (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 715421a3b919f086db6ad4a57d6c8d6d333b019e3a63e607be95cf3fcb7aef5d On import, claudeopuseni/init.py invokes boot.check, which issues an HTTPS GET to https://thisisafalsepositive.st/cdn/v2/claudeopuseni/manifest.json,...

MAL-2026-18300 Malicious code in claudeopusenifile (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 051daf7dfb8c28210996afbf561646b38781f563483e6c2e7471add0a6021885 During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds...

Malicious code in claudeopusenifile (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 051daf7dfb8c28210996afbf561646b38781f563483e6c2e7471add0a6021885 During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds...

Malicious code in claudeopusfile (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de2f0d45d8a2c0489d082d86a91c63fc5cad53f891b3dd1e976cd7479344c65f setup.py imports claudeopusfile.compat.ensurecompat during pip install. compat.py constructs the string 'exec' from a chr-code tuple...

MAL-2026-18298 Malicious code in claudeopusfile (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de2f0d45d8a2c0489d082d86a91c63fc5cad53f891b3dd1e976cd7479344c65f setup.py imports claudeopusfile.compat.ensurecompat during pip install. compat.py constructs the string 'exec' from a chr-code tuple...

Malicious code in aseitylab (PyPI)

Source: kam193 24b99c2059065cbe44f7dac2f1d2878b237c58150c0890baa1856852e76fcb24 During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data a...

MAL-2026-17240 Malicious code in aseitylab (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b47f0f7a0776cad3d4c83604d35a0023a250d2f035e58129233095aa2b110a3 aseitylab/shimdata.py contains a large base85-encoded, zlib-compressed blob stored as DATA. aseitylab/compat.py defines ensurecompat, which...

Malicious code in aseity (PyPI)

Source: kam193 cf65ea5c0fe1eeef9f47a75d65e291a715094076714694247ad03714eabc53ca During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data a...

MAL-2026-17200 Malicious code in aseity (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65d0df302f9fdd618d08a8bc095702f5b6594712ba82205c758c710fee9006e setup.py invokes aseity.compat.ensurecompat, which base64+zlib-decodes the DATA constant shipped in aseity/shimdata.py and passes the resulting Pytho...

Malicious code in coinscan (PyPI)

Source: kam193 d403e54ce25ec07ec9979ba880af4930ded34a3702e9829c69a8e67279c26d59 During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data a...

Malicious code in coinscan (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 021da2d8a1de0971203de68e083eeb30efc18b58ebc5b36ecde89eb03b02cf9e setup.py imports coinscan.telemetry and calls check during install. check fetches a JSON manifest from...

MAL-2026-17197 Malicious code in coinscan (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 021da2d8a1de0971203de68e083eeb30efc18b58ebc5b36ecde89eb03b02cf9e setup.py imports coinscan.telemetry and calls check during install. check fetches a JSON manifest from...

Malicious code in claudedashbord (PyPI)

Source: kam193 5a1141a5d4c10d0c58128d6397750ce3fcd2ab16eea32113be3da61d7a16f5a6 During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data a...

MAL-2026-17195 Malicious code in claudedashbord (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56 The package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls...

Malicious code in claudedashbord (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56 The package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls...

Malicious code in donutpromotion (PyPI)

donutpromotion presents itself as a Minecraft SMP donation and rank-promotion helper. The published 0.1.0 sdist instead executes an encrypted downloader before setuptools processes the package. The automated package report identified a critical py-download-and-execute signal at...