Malicious code in sf-th-requests (PyPI)

Source: kam193 3a4508be29963ffe0a2d8b245449cf80873bdd6037c226e94ff99d9937566c7d During import package exfiltrates the environment variables and cloud credentials/tokens to a hardcoded location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in serverkeeper-verifier (PyPI)

Source: kam193 62ec235d314e175928f82504dade8d7f8313bc88707038976e5be6d78709b869 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in sf-vmeval-requests (PyPI)

Source: kam193 a8fa27c8dc6bf13a4f5d92f14414a4f5efc08c1df7f33591a010b4f824e84bc1 During import package exfiltrates the environment variables and cloud credentials/tokens to a hardcoded location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in redteam-qxz7-utils (PyPI)

Source: kam193 855b67c0cf1aaed6f5e0ce3a67478a20cd4244c56424002feeeb0dea1a875848 During installation, the package exfiltrates cloud tokens from the environment. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-redteam-qxz7-utils Reasons base...

Malicious code in quant-backtest-helpers (PyPI)

Source: kam193 ed851ff141e13db6dd7c16a3d4f1b3b92eb9fa6a917f5243ba22ccb933554e43 During import, package exfiltrates environment variables and cloud tokens to a hardcoded location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in python-cos-sdk-v5 (PyPI)

Source: checkmarx 9d23946b30370561c42df798c468626c8ec508cdf6f0fc22cc34bb67f2fa187e Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security d6fb33a1e6f9e43d03767e7893e2a99c65914fdf3d8aa3657c4aaf7bae91c861 Attack targeted ...

Malicious code in proto-google-cloud-dlp-v2beta1 (PyPI)

Source: kam193 1d21bb408ed0e178e23e5b4face7188968fd711ea7ceab009b9d04e6a508740d Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. --- Category: MALICIOUS - The campaign has clearly maliciou...

Malicious code in polymarkets-sdk (PyPI)

Source: kam193 facfcba74011619f5bb2eaf096e41239f81520cb4effff3b45f8b42c84d42060 During import, the code attempts to exfiltrate to a hardcoded location sensitive data, including private SSH keys, cloud credentials and Windows SAM database. --- Category: MALICIOUS - The campaign has clearly malicio...

Malicious code in playwright-atoned (PyPI)

Source: kam193 250795bc04569c6f87e372e4b6bed019148a1c78f4357e8e430c1865acfead07 The package exfiltrates sensitive data like local environmental variables and cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-05-playwright-acustomed...

Malicious code in inversiones-common (PyPI)

Source: amazon-inspector 347a767ebbbb5843e6b005c167d98c9ab7b3ea943fadd88401682f2a2b14b2a4 setup.py executes a beacon function at module top level before setup is called, so the payload fires automatically on pip install inversiones-common. The beacon collects: hostname, id/uname output, environme...

Malicious code in identityapi (PyPI)

Source: kam193 45946e31faffbed940c8acb3656be0d5f25de7db36f58766cdac44a1e7d6150b During import, only in specific environments, a module containing code disguised as telemetry is imported. This code then exfiltrates sensitive environment variables and cloud tokens to a hardcoded location, as well a...

Malicious code in hellospa (PyPI)

Source: kam193 276fd70d8b56465c07e6a06281b93ef014fcab93ce00be738e645501713dbdda Package exfiltrates credentials, env variables and other sensitive data on running. Notably, exfiltrated cloud credentials were immediately checked from a remote location. --- Category: MALICIOUS - The campaign has...

Malicious code in graphcore-cloud-tools (PyPI)

Source: kam193 ac46cb60f0875363e708276c64f0c8fa73c50f57eed28170f94437a5954f89fd Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in google-cloud-iam-credentials (PyPI)

Source: kam193 e75faf49c379401db38883bfb490edbc74161e0d52d38f6aac38f6166645133a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in google-cloud-datacatalog-lineage-producer-client (PyPI)

Source: kam193 73ea760146181d2911e0823c121502506892b2e63d3fc20d6281fb2c86e03de8 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in fwk-amigapython (PyPI)

Source: kam193 8b565888509e90341d144143aa8e323b0e295d74f3857af52d94930d9d03a30f During import, only in specific environments, a module containing code disguised as telemetry is imported. This code then exfiltrates sensitive environment variables and cloud tokens to a hardcoded location, as well a...

Malicious code in fwk-amigapython-amigamlserver (PyPI)

Source: kam193 5d6f09429b123469b1fc83ceb4af35c595ff4b6e2631552fc857922ca921c4c5 During import, only in specific environments, a module containing code disguised as telemetry is imported. This code then exfiltrates sensitive environment variables and cloud tokens to a hardcoded location, as well a...

Malicious code in fwk-amigapython-rest-server (PyPI)

Source: kam193 9694db9e75e6f3f31137edfba3f3a51ede2881961ee930ea4a4b02e1be086fc8 During import, only in specific environments, a module containing code disguised as telemetry is imported. This code then exfiltrates sensitive environment variables and cloud tokens to a hardcoded location, as well a...

Malicious code in enumer-iam (PyPI)

Source: kam193 8062489d0fe9ae58c1937e4afba7f0f3adfbd507e07dd81bb9450bf7f58c6943 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in enumerate-iam (PyPI)

Source: checkmarx bfefcae6c29da10e63d630fc7e012995d730cc5c0af3a8144dc517f26382a3bd Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security cc5e304091eeb9848bd177dfd300a7df7778e3913b42af19741f6cddec4be752 Attack targeted ...