Malicious code in lightning (PyPI)

Source: kam193 703ac419d775488be137d7e01517d768da0b5581ab63338fb9523f2289f2b92c Versions 2.6.2, 2.6.3 were compromised. Compromised versions contain injected code that starts automatically during importing the module, downloads legitimate JavaScript runtime, and executes included JavaScript...

Malicious code in license-checker (PyPI)

Source: kam193 a636a791b9731fe5018309c2e7890934873ab4c091520d933029f170a1848592 Package exfiltrates content of .env files to a remote target --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-08-import-license-checker Reasons based on the...

Malicious code in kekovayalibka (PyPI)

Source: kam193 62e5215c3a679298336a19cefc6971dc3ab4d26a68a1ee1b7fdafe97b7d2c8d0 Package is prepared to exfiltrate sensitive files. Different packages use different places for the malicious code: it runs during importing the module, is placed in a native binary, or in the setup.py script ---...

Malicious code in jupiter-sdk (PyPI)

Source: amazon-inspector f8e0901ca45da110106c60f288b0166fc51c348a44569d7e7ff22af3d19deafe On import jupitersdk, the package's top-level init.py fetches a payload over HTTPS from a public IPFS gateway https://gateway.pinata.cloud/ipfs/QmP2RrfNCNabLzPYncMGgFwAmttDafczpJLS8oxvQRBVqg, passes the...

Malicious code in instascan-pro (PyPI)

Source: kam193 94d76fe0beb67ab3d875d659dac44b4650be6b8f5bbb4b43635c0fc2fa7b4af9 The package contains a module prepared to collect and exfiltrate user's files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-01-instascan-pro Reasons based on t...

Malicious code in import-license-checker (PyPI)

Source: kam193 c41ca4c8119fa20f7f5915b34de59f879b77fedf237cbbf5a69e46ddbeded428 Package exfiltrates content of .env files to a remote target --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-08-import-license-checker Reasons based on the...

Malicious code in icloudprocessor (PyPI)

Source: kam193 67b215e1995682b83e1afa8c297ecbdfe93d12db8cc11341b6bda84116d95814 During importing, the package starts a thread that exfiltrates user's files --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-01-icloudprocessor Reasons based on th...

Malicious code in icloud-recovery (PyPI)

Source: kam193 3639028f2f9d36c20b55c655b1d71bc053827f4703e7954b12a4ec3da8edd8d2 On importing the module, the code exfiltrates text files, with the focus on configuration files --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-01-icloud-recovery...

Malicious code in hyperreq (PyPI)

Source: kam193 a4662a05cce5bc61521e977b78c1abdb16ecaed027888309aa86ebf22166222b Importing the module starts an Infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-09-hyperreq Reasons based on the campaign: - infostealer - obfuscation ...

Malicious code in hashtools32 (PyPI)

Source: kam193 689514b83cd6496b0a4213d26325e73cd2c4f0e19128b969d19797bcdd4b131d During import, the package attempts to exfiltrate sensitive Telegram session files --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-02-hashtools32 Reasons based on...

Malicious code in hash-utils-py (PyPI)

Source: kam193 4177b7c46ecbfa35116b35a2a491107d0514cd6551a447b7213ef6e097172939 During importing the module, the code attempts to exfiltrate sensitive Telegram's client session files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in hahabott (PyPI)

Source: kam193 89ed03d9e80d4ef62c54087a12177f795e478b1b5e5a8af69ef4e4740e102186 If run as module, it attempts to automatically destroy user's and system's files. Some versions also exfiltrate them. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in h4xupdate (PyPI)

Source: kam193 0de4da975d7b071824607be751a9ea0fb13e409eaef58d1cc0628263d5dea700 Package contains a remote control tool taking orders from a hardcoded Telegram bot. The authorship impersonate legitimate company. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in graphicctx (PyPI)

Source: kam193 8867133b18f35132bf0096bdbd5d1891e87f8a07bbba09f6dffe21c8b048596e Packages in this campaign are used to exfiltrate data from users installing code from prepared Github repositories. Packages contain code to exfiltrate files typically .env files, but it could also be log, txt or code...

Malicious code in graphicsctxr (PyPI)

Source: kam193 10408decaf8cace14b8124fa392ee96996c3c91358cb454cbfcd45790d18cdf9 Package contains code to exfiltrate .env to a remote target. Prior to version 2.1.1, it also created a persistent backdoor via embedding a hardcoded SSH key. Malicious action is triggered when running as a module. ---...

Malicious code in graphicsctxs (PyPI)

Source: kam193 4786ca298bffb09916e622e06411ae44cb51c842a6eb9bf7bcf445c051463888 Packages in this campaign are used to exfiltrate data from users installing code from prepared Github repositories. Packages contain code to exfiltrate files typically .env files, but it could also be log, txt or code...

Malicious code in giteegit (PyPI)

Source: kam193 4a26c5d911f4394086eca9dfca0dfb8b05cc0675bac36dfdbec08e30f6d1abed Package exfiltrates source code files to a telegram channel, while the description promises saving them to a git service --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign...

Malicious code in git-config-sync (PyPI)

Source: amazon-inspector 8e49db03099f1d6053a9ebada346c3816399bc47918c92d765162128a095c401 On import gitconfigsync, the package's core.py spawns a daemon thread after a 3-15 second random delay that walks /.ssh, /.aws, /.ethereum, /.config, /.docker, /.kube, and the current working directory,...

Malicious code in gen-user-random-agent (PyPI)

Source: kam193 4e261c26a73604aac348f2df96e5b12b0817010a9a1bbc48ddfbe309915c697b Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code, exfiltrate TXT files and finally installs infostealers -...

Malicious code in gauth-client (PyPI)

Source: kam193 aea1fab5eb3b9422c65232e53e79eb71ba3436355601cd61e7a7b0177779df4e Package impersonates Google and attempts to exfiltrate various credential files. It also setups PTH file for automated start during Python initialization. In the analyzed version, the exfiltration target was set as...