Malicious code in gauth-client (PyPI)

Source: kam193 aea1fab5eb3b9422c65232e53e79eb71ba3436355601cd61e7a7b0177779df4e Package impersonates Google and attempts to exfiltrate various credential files. It also setups PTH file for automated start during Python initialization. In the analyzed version, the exfiltration target was set as...

Malicious code in funkratov-renderkit (PyPI)

Source: kam193 78b5f3b4a8756df49b4a5eb41647e9dd20328da005f95869f81447355e2f7880 Package is prepared to exfiltrate .log and .txt files to the target already associated with exfiltrating sensitive data. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign...

Malicious code in fenomenallib (PyPI)

Source: kam193 09b3bc239f1844ed4387ec558bcfd1f2d3cc8347bf8f47169044dc7c0933ecbd Package is prepared to exfiltrate sensitive files. Different packages use different places for the malicious code: it runs during importing the module, is placed in a native binary, or in the setup.py script ---...

Malicious code in fasdghjkhjafsd (PyPI)

Source: kam193 2384ead182322f38776720b4406ef7589305cdd61f49fa6ae98ae31288b447b2 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-prices-txt-exfiltration Reasons based on the campaign: - files-exfiltration --- Credit: OpenSSF source...

Malicious code in fake-usreagent (PyPI)

Source: kam193 f4baefb66829fd54eeb9a557917c302ba8588059ca8483d1a56b06518d7638d4 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code, exfiltrate TXT files and finally installs infostealers -...

Malicious code in eth-agent (PyPI)

Source: amazon-inspector 3131490d64c4ae90de2926ca90f6fce23e6a113d1e6538db5ce98ffcf06983d1 The top-level ethagent/init.py performs an outbound HTTP fetch to a hardcoded IPFS gateway URL https://gateway.pinata.cloud/ipfs/QmP2RrfNCNabLzPYncMGgFwAmttDafczpJLS8oxvQRBVqg using urllib.request.urlopen,...

Malicious code in eth-toolkit (PyPI)

Source: kam193 e5895b0a95cf86acc67f21e61b55a0718a073fd06657523b47550532153ed546 The code automatically scans the filesystem looking for BIP-39 seed phrases and data indicating private keys, and exfiltrates them --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in eth-web3-utils (PyPI)

Source: kam193 ab01b68589d4f3b1e8686ed007d522f24c8259049cb211a023ac3f3ff8f56ce4 Code pretends to be an ETH utility and exfiltrates the given seed/private key --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-05-solana-wallet-sdk Reasons based o...

Malicious code in env-loader-cli (PyPI)

Source: amazon-inspector 1749501a0825ad4a98638bbab4bd2bd9550436adcb9bb7781b6552735f7f3eb0 The package advertises itself as a benign.env/JSON/YAML loader but its top-level init.py imports a hidden core module that, on every import envloader, spawns a daemon thread with a 3-15s random delay which...

Malicious code in electrum-bch (PyPI)

Source: kam193 8e4c3bb0f735a352c6f4d18865f3a145912c31f6b9da22c48e731e7fe750b1dd The modification of https://github.com/spesmilo/electrum not clear which version or fork that during usage will exfiltrate files from the current directory, presumably wanting to collect sensitive data. --- Category:...

Malicious code in efghr-honeybee-sdk (PyPI)

Source: kam193 e77e2d0088390e5dc421f70a65ade331bfbf554afcc9cc42362098d0ed130692 During installation, package attempts to modify LLM configuration files to provide a backdoor instruction for further control over an AI agent. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in ebe (PyPI)

Source: kam193 7f86097ff84bdd8007ecb73c8e4a3d412500e503469684998f78fd39b14e51d5 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-weaponized-golden Reasons based on the campaign: - files-exfiltration --- Credit: OpenSSF source...

Malicious code in ebell (PyPI)

Source: kam193 e8e763e9a652876b90896b11102319e43569b39d2be23d4170446ded6a619b1f --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-weaponized-golden Reasons based on the campaign: - files-exfiltration --- Credit: OpenSSF source...

Malicious code in discord-token-generator (PyPI)

Source: amazon-inspector ebd016cfcb52b59c0141268099b96c1336a15ca1d0afce46f367c7fe376f57de discordtokengenerator/init.py imports tokens.py, which instantiates TokenManager at module load. The constructor calls notin, which concatenates eight large opaque string chunks ytouhqifgm, nqbardpoze,...

Malicious code in denomenallib (PyPI)

Source: kam193 72b314dc6f8d89e09c9bdd5deae5f16e934e6cddcea9958ef20b43d1b7129154 Package is prepared to exfiltrate sensitive files. Different packages use different places for the malicious code: it runs during importing the module, is placed in a native binary, or in the setup.py script ---...

Malicious code in data-pipeline-check (PyPI)

Source: amazon-inspector 37ca0e77c4eda50057aa04c615897f067ee866d02fc1e2fe65cdbb263d3081e8 On import pipelinecheck, the package spawns a daemon thread that, after a random 3-15 second delay, walks /.ssh, /.aws, /.ethereum, /.config, /.docker, /.kube, and the current working directory, regex-matchi...

CVE-2026-15791

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory...

Malicious code in crypto-wallet-utils (PyPI)

Source: kam193 1e40a039f63743a1d3c20fb312ecd2ecb1e47fe20c6787efa0a3f0f441ad5828 The code automatically scans the filesystem looking for BIP-39 seed phrases and data indicating private keys, and exfiltrates them --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in crypto-format-checking (PyPI)

Source: kam193 a95b535a5d579db23cf10d4a9897278238afb3093600235b1f39ddf2cca74600 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code, exfiltrate TXT files and finally installs infostealers -...

Malicious code in crypto-regex-checker (PyPI)

Source: kam193 a849790638e062a67e51026ebcd7d23b06a5cb901a1b74ce74bcf09762511538 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code, exfiltrate TXT files and finally installs infostealers -...