Malicious code in syswatch (PyPI)

Source: kam193 e01fd8b85a9d6bdfbefb70261f49496f8a6c224d98da6400ef0ca06f18404d27 During import, malicious code is started in the background. On Windows, it downloads and installs a malicious executable, and disguises it as a system utility. After installation, the code attempts to cover its tracks...

MAL-2026-12083 Malicious code in crypto-wallet-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d0bf047680c46c2f4c37c8a7b77e9d993acb05ef4925c660e0c5cccf95be581f During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in lightmock (PyPI)

Source: kam193 a3c7924362f935b55a808e1ede8ffea2dbc96326b853dc00d7ede36c002ff63c Clone of a legitimate package. During import, heavily obfuscate code downloads next stages and finally exfiltrates sensitive data, including data from web browsers. --- Category: MALICIOUS - The campaign has clearly...