Malicious code in humbility-shared (PyPI)

Source: kam193 bad6120ea5f69f851eafe78dfbb832979077fa6c0175c2bdda88bf073b8ad487 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

AgentSmith-HIDS

AgentSmith-HIDS --The name of this project was inspired by the movie - The Matrix English | 简体中文 THIS REPO IS OLD RELEASE VERSION: https://github.com/bytedance/Elkeid About AgentSmith-HIDS Technically, AgentSmith-HIDS is not a Host-based Intrusion Detection System HIDS due to lack of rule engine...

Zeek-Endpoint-Enrichment

Zeek-Endpoint-Enrichment Enrich Zeek logs with host information To enrich all logs with an id field, use the tag ".-all". To enrich all logs with an id field, and the Known Entities, use the tag ".-known-all". To only enrich the conn.log, use the tag ".-conn". To only enrich the conn.log, and the...

MAL-2026-18769 Malicious code in lookuptest11 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e9ac24971ad447f0248f201416c1921ca268ddb73ad057eee44eaf4868efb17 lookuptest11 0.0.1 performs DNS-based exfiltration of installer identity to the attacker-controlled domain testa213022.dssldrf.net. setup.py construc...

Malicious code in genblaze-fal (PyPI)

Source: kam193 253796cb8693d039c09267f3d6d398031e3ad27640bb70f21f2e75d2578be649 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in genblaze-atlascloud (PyPI)

Source: kam193 c8d0787ea4049d0bb0321d1b25591f303ee2a5d5351aeb725a67250d0ddf4188 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

MAL-2026-18747 Malicious code in genblaze-atlascloud (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6279c5d7cd957549bcecd8c2e4aa1377bf53c114341a3350a23464de6e18bad9 setup.py registers custom buildpy and install cmdclasses that, on every pip install or sdist build, POST a JSON payload containing socket.gethostname...

Malicious code in genblaze-atlascloud (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6279c5d7cd957549bcecd8c2e4aa1377bf53c114341a3350a23464de6e18bad9 setup.py registers custom buildpy and install cmdclasses that, on every pip install or sdist build, POST a JSON payload containing socket.gethostname...

MAL-2026-18746 Malicious code in genblaze-fal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a271155be7da40cba43376d6a085b75a96c0bb9fed885c421424bc42fd8d07b setup.py defines custom buildpy and install cmdclasses that, on sdist build and install, POST a JSON payload containing the installer's hostname,...

Malicious code in genblaze-fal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a271155be7da40cba43376d6a085b75a96c0bb9fed885c421424bc42fd8d07b setup.py defines custom buildpy and install cmdclasses that, on sdist build and install, POST a JSON payload containing the installer's hostname,...

Malicious code in dbt-adapter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d382d03c04666ce376e75c85a7c1af5ec63c2f203aa1f4787b713c56cbcee831 setup.py in the sdist defines a custom install cmdclass InstallWithBeacon that executes during pip install. It calls socket.gethostname and...

Malicious code in msgpackrpc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55c4f419c883d30c0099a7120b0456d975af824e08310e0750166d074def3204 The sdist's setup.py overrides the install command with a class that, during pip install, collects the installer's hostname via socket.gethostname an...

MAL-2026-18627 Malicious code in msgpackrpc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55c4f419c883d30c0099a7120b0456d975af824e08310e0750166d074def3204 The sdist's setup.py overrides the install command with a class that, during pip install, collects the installer's hostname via socket.gethostname an...

Malicious code in stdid-nyxprobe (PyPI)

Source: kam193 0178d6c7a642f90327546548a88f64bd17da5aa97e519249f515c0e6232c73f1 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in zagents-message-bus (PyPI)

Source: kam193 0d1891d5d76adad51e120baa41752f0cc878b243eb400e7a12aba1616d31d1f7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in zagents-message-bus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 177a91975e11b9b3afbc5089dfc7e4c4fdae1cb05f8307f397956c675533f0d8 pypi package zagents-message-bus is published at an implausibly inflated version 99.99.100 under an internal-sounding name, consistent with a...

MAL-2026-18296 Malicious code in zagents-message-bus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 177a91975e11b9b3afbc5089dfc7e4c4fdae1cb05f8307f397956c675533f0d8 pypi package zagents-message-bus is published at an implausibly inflated version 99.99.100 under an internal-sounding name, consistent with a...

Malicious code in moveworks-capi-starter (PyPI)

Source: kam193 2cd8f99409a87f01743f65f381fefa800176a29d47d6119743ae2bd0ce1f7583 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

MAL-2026-18122 Malicious code in moveworks-capi-starter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82a1f2ebbd0f8423c7e02c1a9b0571cec02bd6d343b88583f6a85dd06a056a99 setup.py overrides the install command to collect the installer's hostname and resolved local IP address and POST them as JSON to the hardcoded URL...

Malicious code in moveworks-capi-starter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82a1f2ebbd0f8423c7e02c1a9b0571cec02bd6d343b88583f6a85dd06a056a99 setup.py overrides the install command to collect the installer's hostname and resolved local IP address and POST them as JSON to the hardcoded URL...