Malicious code in dictmerge-lite (PyPI)

dictmerge-lite 1.0.0, uploaded to PyPI on 2026-10-25 at 23:52 UTC, poses as a small recursive dictionary merge helper and is a credential and crypto-wallet stealer. Importing the package runs the payload: dictmergelite/init.py imports telemetry and starts telemetry.runasync, a non-daemon thread s...

Malicious code in getpubip (PyPI)

Source: kam193 6a07d6dd387bbd88252ffdda7f8c10daf988f0622250daf20e7ec8ee0f63c6d5 During import, obfuscated code downloads and executes an infostealer. Campaign shares some similarities with the campaign 2026-10-fontcase. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in getpubip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d316a35a6fe335032b2c59e47627c0af28bec9688cba40585f1365cab4f4452 getpubip/init.py runs exec on an approximately 2KB opaque payload produced by reversing a string literal, base64-decoding it, and zlib-decompressing ...

Malicious code in fontcase (PyPI)

Source: kam193 9e2c4992e5295f2b094f3c7c2b2e6c2dbc8d0d9ca6242d58318e6e1b83a4255c During import, the package downloads and executes an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-fontcase Reasons based on the campaign: -...

MAL-2026-17862 Malicious code in fontcase (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9e2c4992e5295f2b094f3c7c2b2e6c2dbc8d0d9ca6242d58318e6e1b83a4255c During import, the package downloads and executes an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in fontcase (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9e2c4992e5295f2b094f3c7c2b2e6c2dbc8d0d9ca6242d58318e6e1b83a4255c During import, the package downloads and executes an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2026-17809 Malicious code in minecraftaccfinder (PyPI)

minecraftaccfinder was published to PyPI on 2026-10-12 in six versions within 23 minutes 0.1.2 at 01:05 UTC, 2.0.0, 0.3.0, 0.3.1, 0.4.0, 3.0.0 at 01:28 UTC with no description, author, README or project page. The package consists of one module, minecraftaccfinder/init.py about 87 KB, 88 functions...

Malicious code in requests-cache-utils (PyPI)

Source: kam193 1655ea47fc7ccd39294203776ee3dcb01a394c40d93e05b7b527700b19de42c8 During installation and importing the module, the code downloads and executes an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-17191 Malicious code in requests-cache-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1655ea47fc7ccd39294203776ee3dcb01a394c40d93e05b7b527700b19de42c8 During installation and importing the module, the code downloads and executes an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in requests-cache-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1655ea47fc7ccd39294203776ee3dcb01a394c40d93e05b7b527700b19de42c8 During installation and importing the module, the code downloads and executes an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in lucy-python-script-2030 (PyPI)

Source: kam193 0b93ebb2207ccfa0d02d068d444dce91835203dfe89a5ece38906158b4d3b891 Starting version 0.1.1, the package contains an infostealer attempting to exfiltrate during import various sensitive data, like browser data, sensitive files, cloud credentials and others. In analyzed versions, the co...

Malicious code in solana-sniper-bot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1140920c05a1ce00ca8d35295fb927d1bbb2ca9fe2f8e7ab9f63f9391ca6476b During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-13362 Malicious code in mnemonic-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in mnemonic-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in bitcoinlib-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 32582a69a108bf3ab34d8bd16122918dd29a56bff6f68a771b77c6c946bf9308 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in bip39-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c188f84ee0ad8238ed89a94673968e9f17c44d91d25dfe8012efd39e01705081 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in zakuraweb (PyPI)

Source: kam193 aa544044c8a113eb904f97650e8132de793d3bab5a7328a3714495e3f6a2283e Importing the module starts exfiltrating Discord tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-morosint Reasons based on the campaign: -...

Malicious code in zhopaorlaaato (PyPI)

Source: kam193 45a24b1a49c10f50578e74364357b8de8d31ee62b997c0db957bc0474c841fd7 Package is runs an Infostealer targeting telegram and Discord credentials. Depending on version, the infostealer is either downloaded from an URL or embedded in the package --- Category: MALICIOUS - The campaign has...

Malicious code in web3-helpers (PyPI)

Source: kam193 8d6102ae402b2583a01da47e71f41cccba99fb7826dcf360004d8924557e1760 During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating crypto wallets and browsers data. Likely continuation of...

Malicious code in solana-sdkpy (PyPI)

Source: kam193 fa656c982797b0a9ae09399aa3204b8925d4608935f9b563f498224bebf39b04 Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other, correct uploading URLs Some of related packages only tes...