Malicious code in trajmetrics (PyPI)

Source: kam193 3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271 When starting as a module, the package scans the whole system and exfiltrates selected files by type. If following the README instruction, it starts a background job constantly monitoring the system and exfiltrating...

MAL-2026-18354 Malicious code in trajmetrics (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f024efebedf9b6fd0adbd2aa9b03293b7cdefdcede29ded30128cabc84290f73 The package is published as 'lightweight metrics helpers for trajectory analysis' but ships only compiled Cython.so modules that implement filesystem...

Malicious code in trajmetrics (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f024efebedf9b6fd0adbd2aa9b03293b7cdefdcede29ded30128cabc84290f73 The package is published as 'lightweight metrics helpers for trajectory analysis' but ships only compiled Cython.so modules that implement filesystem...

Malicious code in onsokets (PyPI)

Source: kam193 844774819aa502a53d6d364b6636fa62eb412fe8b30973c226aeb9b7b89865f9 The package contains code for automated files exfiltration. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-proxyrubika Reasons based on the campaign: -...

MAL-2026-18219 Malicious code in onsokets (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86e89c263593521f9795193907958f4c642d34253fe9a65526dea1c681808760 onsokets/run.py walks the Android primary storage path /storage/emulated/0/, collects files ending in.json,.py,.pyrubi, and.txt, zips them by...

Malicious code in onsokets (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86e89c263593521f9795193907958f4c642d34253fe9a65526dea1c681808760 onsokets/run.py walks the Android primary storage path /storage/emulated/0/, collects files ending in.json,.py,.pyrubi, and.txt, zips them by...

Malicious code in qowa (PyPI)

Source: kam193 67fe6a2b86c60720a8e3cc1002c183bd751ec1896d3be13a44b5ce7d1623afbd The package provides a C2 server and agent with pre-filed credentials, disguised as a generic utility. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-qowa...

MAL-2026-18218 Malicious code in qowa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650ce7eeda9c50d942912db7495f8108fcc3b8447ff9bae79a1bd1b105c1b0d5 src/qowa/init.py contains calls to socket.gethostname at lines 30, 52, and 247 together with hardcoded Telegram Bot API endpoints...

Malicious code in resion (PyPI)

Source: kam193 2e9e3ce373adb26e45616eec47d727e557f5a696737cb2fbcaa66fb7dc7b7c3e Description: In this campaign, the main package resion has an embeded pickle disguised as a config. A related dependency pafex contains code to load the pickle. During unpickling, malicious code embeded in the pickle...

Malicious code in pafex (PyPI)

Source: kam193 8ad1f51a6f081ac9e46b3d3ffa2d0b9b150b1600caf826d940f4e3d1992cda16 In this campaign, the main package resion has an embeded pickle disguised as a config. A related dependency pafex contains code to load the pickle. During unpickling, malicious code embeded in the pickle file is...

Malicious code in pafex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f048e6c59bed3c95094e9baaf28b7234a917300b81a4c81db0eb0a3f859ff4e3 No install-time or import-time network I/O, credential access, subprocess execution, or other installer-harm behavior was observed in this package...

Malicious code in marocolor (PyPI)

Source: kam193 38b0fa2ee77af46ad9daf78c024a0f599fd0798eef7605cb3eed50d8db65fa22 Package is intended for stealing files to a hardcoded location and performing a DoS on the victim's machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in marocolor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8206a6d3278ef99ffe6f33a695ca3dd6b4ed9856912d79f3066a375d95bcd509 On import of marocolor, a daemon thread recursively walks the user's home directory and uploads every file matching...

MAL-2026-17900 Malicious code in marocolor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8206a6d3278ef99ffe6f33a695ca3dd6b4ed9856912d79f3066a375d95bcd509 On import of marocolor, a daemon thread recursively walks the user's home directory and uploads every file matching...

Malicious code in proxyrobika (PyPI)

Source: kam193 ca9520dcc3936b679b577bee42392ecb6ee65cd658c4858d325de5c738a7a200 The package contains code for automated files exfiltration. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-proxyrubika Reasons based on the campaign: -...

MAL-2026-17889 Malicious code in proxyrobika (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5242a5c1d50ffd677c3b9b57e28a86baeb0179c10feef81380ef656eecf44206 The package exposes a single public function starts that walks /storage/emulated/0/ the Android primary user-storage root used by Pydroid/Termux-like...

Malicious code in proxyrobika (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5242a5c1d50ffd677c3b9b57e28a86baeb0179c10feef81380ef656eecf44206 The package exposes a single public function starts that walks /storage/emulated/0/ the Android primary user-storage root used by Pydroid/Termux-like...

Malicious code in proxyrubika (PyPI)

Source: kam193 dd55df978007c1a7548ff7e6a548553cf89bd536afffbc8b0921eb3efe31a342 The package contains code for automated files exfiltration. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-proxyrubika Reasons based on the campaign: -...

Malicious code in proxy-rubikis (PyPI)

Source: kam193 0326ad29540efd267d15181087b384b25da962e7bcd6ac40c39641699e212e50 The package contains code for automated files exfiltration. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-proxyrubika Reasons based on the campaign: -...

MAL-2026-17887 Malicious code in proxy-rubikis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0326ad29540efd267d15181087b384b25da962e7bcd6ac40c39641699e212e50 The package contains code for automated files exfiltration. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...