Malicious code in ollamaa (PyPI)

Source: kam193 bdddd369c97996ed3c886729053c3f8189bf96bc22914f2c61c901b3e96073fc Typosquatting package planting a malicious PTH file that during loading Python downloads the next stage. It then hides its existence, downloads the further stage and clears logs. The next stage exfiltrates sensitive...

Malicious code in mnemonic-py (PyPI)

Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category: MALICIOUS - The campaign has clearly malicious intent, li...

MAL-2026-12083 Malicious code in crypto-wallet-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d0bf047680c46c2f4c37c8a7b77e9d993acb05ef4925c660e0c5cccf95be581f During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in popeye-pip-v3 (PyPI)

Source: kam193 940ada25d3157d4f88092627a5a8eedb98abf86933890ce13193d4878d2698ee --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign:...

Malicious code in anthropickit (PyPI)

Source: amazon-inspector f3e103a8a230b5fb3066fb0a9eb7f5fdf5831d4c7b71a9d83de54d8d6673eae2 On pip install, setup.py collects the contents of every file in /.ssh excluding knownhosts and authorizedkeys, so private keys are read, all environment variables whose names contain...