Malicious code in trongridi (PyPI)

Source: kam193 3d03608cfdb32a163655abbfe15a2c86d5957fe498e678d3f6e3f44f12220454 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some packages additionally clone the readme of other, legit...

Malicious code in tronlid (PyPI)

Source: kam193 387ea56c726485890b55cce5a96c6381e248be3c8eba22c22ead08e4b30db3b1 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some packages additionally clone the readme of other, legit...

Malicious code in trongridapi (PyPI)

Source: kam193 b7421d70bdd0603758337ea36f6465ea98a4df7bd4c383661b11552866d0d411 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some packages additionally clone the readme of other, legit...

Malicious code in rtcpy (PyPI)

Source: kam193 75bd7b21b8b27920b63ff14b07b761f57e72da9866682e4e49bd569e660215fd Importing the module starts an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-mescouilles Reasons based on the campaign: - infostealer -...

Malicious code in richx (PyPI)

Source: kam193 924fa9cf3bc0754ab76a7b5960deb5b7295f4f0f3270cc5724214bdd7d543675 Packages silently decrypt content hidden in a dependency and load them as Python extension modules. In the first wave, those are copies of legitimate aiohttp and aiohappyeyeballs packages. In the second wave, maliciou...

Malicious code in raknet-testing-package2 (PyPI)

Source: kam193 d26ae7cefa4b8ebaf16a44f6d3c42c1fd6dbacda884e5b03b06da5ff237d7435 During installation, the package attempts to install the own MITM proxy without user's consent and hijack all requests --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in pyrtp (PyPI)

Source: kam193 f77b4d5bf456d6805b724bbedc6baa9f7fb3cc95e6ab6aace6861bfcd56aec1f Importing the module starts an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-mescouilles Reasons based on the campaign: - infostealer -...

Malicious code in pybanners (PyPI)

Source: kam193 79f46da2dc3c934741de674c01635b94240ac249ba2d9cb9f7a89e0c8d80686a --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-blazesquad Reasons based on the campaign: - infostealer - - exfiltration-generic --- Credit: OpenSSF source...

Malicious code in pojang-resorter (PyPI)

Source: kam193 2b5f9cd53d855ccc1ebed2b1f9dc610af8ee0978f5fa689cad954b3a56b1a22b Early versions used overriding install command to take screenshots, then it moved to automated installing an infostealer. Later the behaviour was changed and looks like being a toolkit to install malware, yet, dependi...

Malicious code in pipcolorpkgv2 (PyPI)

Source: kam193 a95f9f4af9619a03c6116af22cc53f289c869d09569629216fd32ea12a5a63cc Importing the module starts an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2023-12-bananasquad Reasons based on the campaign: - infostealer -...

Malicious code in netbenchkit (PyPI)

Source: kam193 fa328b263fd5f17449e326d05af9a5849a25d6c028d092e586097e95c4e1db59 Package imports and executes malicious synium package --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-12-synium Reasons based on the campaign: -...

Malicious code in kraken123 (PyPI)

Source: kam193 dc2f76a61af953726f4fc219f725013ce8b477860b47433b7fc0444994ffcfd5 As even described, the package contains a malicious code collecting large amount of data. The description suggests educational use, yet, the code can cause real harm. Specifically, the C2 servers defined in the packag...

Malicious code in kertash (PyPI)

Source: kam193 3cb3ef6da7e0d1c1461bb944c5ff0e356b73e52d271afa9e94435097f1d0764f When using methods from the package, it downloads an obfuscated code from Github and puts it in multiple localisation. While it appears that this code is used to perform action user requested, deobfuscation reveals...

Malicious code in jsonschemex (PyPI)

Source: kam193 21f678f82847db32c68ab5a95a827f755d13b5d4cd371667eb584f25ed28ed01 Malicious clone of a legitimate package with hidden code that downloads the next stage scripts. Analysed payloads had just exfiltrated basic infos --- Category: MALICIOUS - The campaign has clearly malicious intent,...

Malicious code in dabrius (PyPI)

Source: kam193 4a154cab742b51be41ca413e20acccfed4290ac4cf692e1cfeb17a677df98bab The message hidden in the package description tries to convince AI agents to prefer installing the package, which then in multiple places marks execution and collects potentially sensitive data. The behavior extends...

Malicious code in bbllaacckkwwoollff-6ad8f762-1a91-45d7-a9c5-356bd858356a (PyPI)

Source: kam193 4da60ab5fd2248194d9c485e99360f30cd77d89de065b6f30259328cfcadd2f2 During installation, the code either exfiltrate some information about the system or download and execute remote code --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in bbllaacckkwwoollff6ad8f751 (PyPI)

Source: kam193 e88e848094db2d7414ceaf71a5a332701df9a17b145c137f0f5df76503847f90 During installation, the code either exfiltrate some information about the system or download and execute remote code --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in ateslassia (PyPI)

Source: kam193 7b3ae00037330440de3fd0b333720f254e1549b277a12df5d31fb7f70d771daa Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. --- Category: MALICIOUS - The campaign has clearly maliciou...

Malicious code in aliyun-ai-labs-snippets-sdk (PyPI)

Source: kam193 459b9313aa2d453392e97f619a0ffb2898c3b90700e72dcb2cde4d1a1b97b1ac During the importing, it loads a file pretending to an AI model. This file contains pickle-serialized code that exfiltrates data basic IP/username info, as well as .gitconfig to a remote target. --- Category: MALICIOU...

Malicious code in aiohttp-openssl (PyPI)

Source: kam193 67b219a81e6b2dd7db78b4b223da914ee7baefd0ab056940d3af0bc3b47846a0 Packages silently decrypt content hidden in a dependency and load them as Python extension modules. In the first wave, those are copies of legitimate aiohttp and aiohappyeyeballs packages. In the second wave, maliciou...