Malicious code in system-health-check-test-unique (PyPI)

Source: kam193 10bfd6e986187675dd7d7e3a8f860807e408fd6a91694ca0e0128be83fa8fc47 Importing the module exfiltrates content of /var/www/html to a remote host --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-12-system-health-check-test-unique...

Malicious code in svchost (PyPI)

Source: kam193 a56926028e7e253a1ffb3ba27d6514a5cbc6b23964d7e1094846a895dd322656 Code exfiltrates sensitive crypto wallet's files and sets up a keylogger trying to catch the password to the wallet --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in solanakit (PyPI)

Source: kam193 3e8770458eab636335241e359b6cee149cc00640fb2418b4462c89ec88accc93 During import, the code downloads and starts a malicious package hosted on GitHub. It then first ensures persistency e.g., through the autostart registry key. Then, based on the encrypted config, an exfiltration demon...

Malicious code in solana-wallet-utils (PyPI)

Source: kam193 0fafa4851b72650b6cb905d88ab0e9ac73276e188d44bf1ff2cb010eb6945c59 Code pretends to be a crypto utility but exfiltrates given private key / seed --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-05-solana-wallet-sdk Reasons based o...

Malicious code in solana-py-sdk (PyPI)

Source: kam193 410be1fb5add67052173f65435e5dcc6c97d9eda056afa09c612e1afe242be47 The code automatically scans the filesystem looking for BIP-39 seed phrases and data indicating private keys, and exfiltrates them --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in sol-regex-gener (PyPI)

Source: kam193 863af188c3f151e9ad44d0ed55e0a5faa7120032979ffcdbc822b6dd488dfc12 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code, exfiltrate TXT files and finally installs infostealers -...

Malicious code in solana-scanner (PyPI)

Source: kam193 047a41b9a67bb975c2e98b31b5e13875569de5097f0b61bb5984e300687e03e3 The code automatically scans the filesystem looking for BIP-39 seed phrases and data indicating private keys, and exfiltrates them --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in soali (PyPI)

Source: kam193 6c73ab625e57bbab36d706b35ebf4f344a01e77b5f6f53b71765e029a845ee12 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-weaponized-golden Reasons based on the campaign: - files-exfiltration --- Credit: OpenSSF source...

Malicious code in soal (PyPI)

Source: kam193 acbef83f8fce2a2944f16812b0a2f89f92b4b0e0902439a4224b7ddd2b516f9b --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-weaponized-golden Reasons based on the campaign: - files-exfiltration --- Credit: OpenSSF source...

Malicious code in scraper-npm (PyPI)

Source: kam193 5705e85e8288aeffbfe964329624dcbb5b2e30cebb0023da5b605ee5fb0aef4e During import, the package exfiltrates files especially .env and JSON and eventually configures a backdoor by adding its own SSH key to the authorizedkeys. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in sccket (PyPI)

Source: kam193 5a4f6b8eead6d682b7462da07822a284425fa81c17b9493dd8702ba6a8e5fbb7 Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-03-randomwifi Reasons based on the campaign: -...

Malicious code in runwifi (PyPI)

Source: kam193 83046dbbe0f24ed7ffb9087d78c161e332436c45f2f3f4433606ebb9fd9cc52d Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-03-randomwifi Reasons based on the campaign: -...

Malicious code in runningwifi (PyPI)

Source: kam193 7c510d8dbbc3448272c337960c786b9b9731fe97773a4bfd48844527c7e6bed6 Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-03-randomwifi Reasons based on the campaign: -...

Malicious code in requestn (PyPI)

This package is considered malicious because it extracts OS files of the localhost and sends the contents to an unknown Telegram channel. --- Credit: OpenSSF source...

Malicious code in request-wizard (PyPI)

Source: kam193 ff748393cb55e78c43fea879bbd55034152148246aa8d45359cfa8517845e17c Importing the module starts an Infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-09-hyperreq Reasons based on the campaign: - infostealer - obfuscation ...

Malicious code in renderctx (PyPI)

Source: kam193 7c668f58ae62e49c301d2e437e96818f41e221768509cfb4cf80b9800b5adf5a Packages in this campaign are used to exfiltrate data from users installing code from prepared Github repositories. Packages contain code to exfiltrate files typically .env files, but it could also be log, txt or code...

Malicious code in renderkitcore (PyPI)

Source: kam193 a66bf58bff553ec613604164eb60adcb89fcde468491b746838a6e2c18b0e3a0 Package is prepared to exfiltrate .log and .txt files to the target already associated with exfiltrating sensitive data. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign...

Malicious code in randomwifi (PyPI)

Source: kam193 69dd88ab3dd3a84c89517f453703ddfd713ccc663b6641d5cf098e17bcdfe500 Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-03-randomwifi Reasons based on the campaign: -...

Malicious code in randomstringgen (PyPI)

Source: kam193 9fc95ea566ad1938f7f75123eee2d8b3365bf55f06d7aa8a5f569f5e4c696132 Using the provided function results in exfiltrating the current running file likely the user's script to the hardcoded location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in rcebymrx (PyPI)

Source: kam193 65ddcbfb52d8c96bb51c713d62841675f75e9e5225efc9380917c6cf79bed8ab When importing the module, the /etc/passwd file is exfiltrated --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits,...