Malicious code in wisecloudsecrets (PyPI)

Source: kam193 e4ed4357b3e8038ef404e043cc63aafe6484b20d94267c4f024a27d840a4a2fc During import, only in specific environments, a module containing code disguised as telemetry is imported. This code then exfiltrates sensitive environment variables and cloud tokens to a hardcoded location, as well a...

Malicious code in veriftest1asdlaaa (PyPI)

Source: kam193 8ca63296b7d7f9b656944bcaf65cc918b709a2071d1ea5f16d1a7422a9df931e During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-veriftest1asdl Reasons based on the...

Malicious code in veriftest1asdla (PyPI)

Source: kam193 e04795c3a8f7fae13a125bde307aa64db04ae9f4ff76bd1d11fb32b4d3f57a36 During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-veriftest1asdl Reasons based on the...

Malicious code in veriftest1asdl (PyPI)

Source: kam193 e11e583c94e6aea422cd70561ea53212b4b4a26dd4bcb2e42c4c1ad25066474d During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-veriftest1asdl Reasons based on the...

Malicious code in veriftest1asdlaaaa (PyPI)

Source: kam193 18d30d48c72a61cda2e8b0ecd3a27b958e8964b4c65833cb780186382285101d During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-veriftest1asdl Reasons based on the...

Malicious code in veriftest1asdlaa (PyPI)

Source: kam193 84fe70a8f5e34c8334d7284bcc9b71826210f029708a53a6ec4b9bb90a33054b During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-veriftest1asdl Reasons based on the...

Malicious code in tinkoff-cloud-apis-internal (PyPI)

Source: kam193 30caca1d5e67322644a0eb6cf8098151d975415baab826d14a0bba75117ae95e Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an...

Malicious code in timekeeper-verifier (PyPI)

Source: kam193 3a20fe9fed2445d097ddfd628d59e1b8149913aec4915c112cacfa9fb7cdfc6e This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in time-server-analyzer (PyPI)

Source: kam193 95abdeda4b05cb93bb442d77d1b339498503b1fddb72e3579359f39c5952513b This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in time-server-test (PyPI)

Source: kam193 8a160dff2a937ad50482cc2b8c8bcd1b7e7c37aefb584bd26515edfecdd4052f This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in time-check-server (PyPI)

Source: kam193 a5da6618a6f04ceb52acd56bc78e318cb7fbffa07ef3acc041729afe52428c44 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in time-check-server-get (PyPI)

Source: kam193 25b39f6b89687636c8f9e90e3c326bcfb64ecbfa2594850247d4d2e9646b9257 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in thief-utils (PyPI)

Source: kam193 bcebc8919f53e78dae4adb16168fdd37abea93d969d3411b948ed1781c6faf28 During installation, package attempts to exfiltrate cloud credentials and sensitive env variables --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-03-thief-utils...

Malicious code in testveriftest1asdlaaaaa (PyPI)

Source: kam193 ff36b3e2ad882727ed964a43d4599f3713d2bada89b6cec169d727127c21c2fa During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-veriftest1asdl Reasons based on the...

Malicious code in testveriftest1asdlaaaa (PyPI)

Source: kam193 3b241cae62c005e3cd31a8251941ab101ebcca75aa4c8cb988905e87529339cd During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-veriftest1asdl Reasons based on the...

Malicious code in tencent-cloud-python-sdk (PyPI)

Source: google-open-source-security bf236cca18e4d157a57cd3de7abed8ad967103c42b9ae53f5026174af46b64a4 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategicly chosen functions and would only trigger when these...

Malicious code in telethon2 (PyPI)

Source: checkmarx 2f513e1bd0172cda035284efad9368870bc46158926c112ccd7fc881e6af75be Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security 9308df1a062441007b83384d6d5c1b9103eeae76a21599ea43aeaae5e839b243 Attack targeted ...

Malicious code in tcloud-python-sdks (PyPI)

Source: kam193 601415ac1e4afe43331c4b78d99e406f34b4a970a365a366cdc0598c5cb22f9c This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in tcloud-python-test (PyPI)

Source: kam193 221affa8a84428ae21f288ce299d114742d269e7bbcbf223a0aa666327fae2c4 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in tclients-sdk (PyPI)

Source: kam193 7e1b954f34e0b9f14cca18b47f856a049c06e3503f3186ec2ae4db717a1298a8 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...