Malicious code in randomstringgen (PyPI)

Source: kam193 9fc95ea566ad1938f7f75123eee2d8b3365bf55f06d7aa8a5f569f5e4c696132 Using the provided function results in exfiltrating the current running file likely the user's script to the hardcoded location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in rcebymrx (PyPI)

Source: kam193 65ddcbfb52d8c96bb51c713d62841675f75e9e5225efc9380917c6cf79bed8ab When importing the module, the /etc/passwd file is exfiltrated --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits,...

Malicious code in qtpv (PyPI)

Source: kam193 2e0cfa610f53699fb3d04d6296bf28540a6162be41a7268566e999b070b517a6 Importing the module starts exfiltration of ".session" files, which appear to be used at least by one Telegram library https://docs.telethon.dev/en/stable/concepts/sessions.htmlwhat-are-sessions to store credentials -...

Malicious code in qlinforge (PyPI)

Source: amazon-inspector 713a696ce725031aab16903d7a29c80611a4c4368c7e35bacf29069a3581c602 setup.py registers a custom install command that, on Linux, downloads an opaque binary from http://115.190.124.243:9090/payloadlinuxamd64 to /tmp/.cache, chmods it executable, and runs it with a C2 argument...

Malicious code in pytzv (PyPI)

Source: kam193 bc7b0a2cddf6ee0cc4d688f4136758e0d7aaa99707aa5dd82505d84631d77720 Importing the module starts exfiltration of ".session" files, which appear to be used at least by one Telegram library https://docs.telethon.dev/en/stable/concepts/sessions.htmlwhat-are-sessions to store credentials -...

Malicious code in python-files-mod (PyPI)

Source: kam193 3f9a5cad398dbfcea1ea0ed1a7b20c678a67941581a4562aa92703ac86ee421a Disguised as file system manipulation library, the package hides an obfuscated code to communicate with a Telegram channel. Though the usage is not known at the moment, the package is clearly created for data...

Malicious code in python-module-installer (PyPI)

Source: kam193 61bfa181c5afb9e33e0d529138c813fc05d8130062182d9d1a5cb4ef9c8da0ea The package clones a legitimate webdavclient3 library and modifies it to be an installer utility. During installation, the package exfiltrates the current working directory to a remote WebDAV server or Telegram Bot...

Malicious code in python-aiogram-telegram-updater (PyPI)

Source: kam193 94b286136c318836563c0eaddf44e8d1b21f217086b444a3266d91b69ace79b8 When run, the package exfiltrates files from a cryptowallet and modifies its executable placing an implant exfiltrating passphrase later. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in pycryptcore (PyPI)

Source: kam193 3337f9433143a04e30ce5881c7786f787cc882c983ed5e68b22f60fd79f2a0dd Typosquatting package that automatically exfiltrates files to a Telegram channel on importing. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-05-pycryptcore...

Malicious code in pwn-control (PyPI)

Source: kam193 719b4c85917a0a8bc84e7591598b0d17098dd32c8f29b5c09eb25fe1d3e079c3 During installation, the code runs code to silently control the device via Telegram bot execute commands, exfiltrate files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in process-support (PyPI)

Source: kam193 ba15c5dd66c6282ee21f8ee819191d6fbbbf194845ad231ac7d26856d334db70 During import, the package automatically starts code acting as a RAT. It connects with a hardcoded C2 server and waits for commands, supporting e.g. executing remote commands, exfiltrating files, recording the screen,...

Malicious code in pckg-sv (PyPI)

Source: kam193 2ae45d504dadccaa437ebeaa729136ca7b38074149772b076c7abb34ab1e81f4 Code exfiltrates sensitive crypto wallet's files and sets up a keylogger trying to catch the password to the wallet --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in pdf-converter-pro (PyPI)

Source: amazon-inspector 0b3a5f6d1d39c20feca11d0129f0efa21bdf564586045555b756cc25bce73efc Package is advertised as a PDF converter but contains no PDF generation code. Its sole public method TXTtoPDFConverter.createpdftxtpath, pdfpath is gated on the literal arguments 'file.txt' and 'file.pdf';...

Malicious code in paperclip-ai (PyPI)

Source: kam193 643de4cab1ea2f7becbca5a7dead46fcb39f35596d2bf7a371fdd2c82ded1530 A clone of a legitimate package with added code that exfiltrates env variables and multiple sensitive files: credentials, dotenv, shell history, etc. Exfiltrated credentials were quickly validated by the attacker. ---...

Malicious code in open-vp-cal (PyPI)

Source: kam193 ab8c06b5d7e9b98d62708ab7377d9e18a214e884c69b0c7217979121aed06917 When executing the module, the code installs a package from a remote location. The remote package contains malicious code exfiltrating selected env variables and selected information from credential files. The code...

Malicious code in neov (PyPI)

Source: kam193 0c9e3f275318dc63c36dbc902dfd73c0b3aa4fa830d114c0833ed8d24258d9b0 Importing the module starts exfiltration of ".session" files, which appear to be used at least by one Telegram library https://docs.telethon.dev/en/stable/concepts/sessions.htmlwhat-are-sessions to store credentials -...

Malicious code in metemask-sdk (PyPI)

Source: amazon-inspector a99855c93b46f7b996a005065c319bbb24c9d1f497d05dfd38fc83d1b21facdd metemask-sdk is a typosquat of the legitimate metamask-sdk package. On import, the top-level init.py performs an outbound HTTP fetch to...

Malicious code in mangrove-sdk (PyPI)

Source: kam193 d6714958f20775c2347e9c8b606d1de2e28ed29fe4b1a82261ca4fb966fc20fa During installation, package attempts to modify LLM configuration files to provide a backdoor instruction for further control over an AI agent. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in manik (PyPI)

Source: kam193 9f5401ff0b4189038b0682df9360adf8a7b3f1c0b19f41726a9bb1ebb6770d5e During installation, the package exfiltrates random files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-manik Reasons based on the campaign: - The package...

Malicious code in mainx (PyPI)

Source: kam193 6a77aad2f42165ec9582f04fffab948f6a1125564e34f4d09c8d089b2708d8d2 While described as educational package to simulate post-exploitation environment, the malware is active and once started, automatically attempts to exfiltrate sensitive data credentials, cookies, etc. and places a...