Malicious code in journey-test-hellospy (PyPI)

Source: kam193 418fea1fe789e9a44c77c08c9135b3da66b773882c9fb2757094c3f55b04321b During installation, package exfiltrates potentially sensitive environmental variables --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-journey-test-helloshell...

Malicious code in solivoxtts (PyPI)

Source: kam193 c512c506dd4828aef5dd993cce389de4500f6c2e3c1906f1440e71cf455c64e7 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in iterquarry (PyPI)

Source: kam193 229de224c9319ae50283d0c8fb0f76e351d82327ac204193b7dd2d62026ee41d In this campaign, one package iterquarry holds an encrypted payload, while another one libseal provides algorithms to decrypt and execute it. In earlier versions, the code used an embedded key and the payload was...

Malicious code in zennittts (PyPI)

Source: kam193 8a405494d56b12c5eabd44355e1b97dd09406522e9e2211193e6df2123592dda This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in dictanovaasr (PyPI)

Source: kam193 afc8d83a420096900bdccd11b4ed6f45011c624cbc47c25a486576418203f4dd This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in melcuratts (PyPI)

Source: kam193 8bd7e6eda0ded5ef0e82eac489faca560422a8b8e46fd9c8d9b8215d9e89e6ba This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in aurenatts (PyPI)

Source: kam193 ecc8915a04d9fbab4ecc0437f5eb05357d2e63bc3d30f629d67c7b3eb2c98eeb This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in codecraze (PyPI)

Source: kam193 1811daf51a786c7fc7dfea9a979a5f53626825eca9d18b61220b6366617ecb33 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in brummatts (PyPI)

Source: kam193 605ea05e6c6344e7ddfb713297d7689ee050288b74ecbf0821039603dc3cdd45 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in crenelatts (PyPI)

Source: kam193 4ccd88fc743d2fd427510543af873fff8780bb4ec4916a565afb729315f28068 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in pipegrip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 69da6e2696ea51627e314534617b3a5507896dd6375f600ae4a71d84ace79609 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18154 Malicious code in pipegrip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 69da6e2696ea51627e314534617b3a5507896dd6375f600ae4a71d84ace79609 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18153 Malicious code in hookgantry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8f2adef4202c047248aedfecfea60e5c71798b9a9f15999a7f9c76e6a5471dab This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in hookgantry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8f2adef4202c047248aedfecfea60e5c71798b9a9f15999a7f9c76e6a5471dab This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18152 Malicious code in acousticpack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e9796cf3d8fa108f7e354640578e92abd850a9b899dbc8e0e22f14e40bcd4a02 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in acousticpack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e9796cf3d8fa108f7e354640578e92abd850a9b899dbc8e0e22f14e40bcd4a02 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

web_exploit_detector

Web Exploit Detector Introduction The Web Exploit Detector is a Node.js application and NPM module used to detect possible infections, malicious code and suspicious files in web hosting environments. This application is intended to be run on web servers hosting one or more websites. Running the...

Malicious code in dictanovaasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 afc8d83a420096900bdccd11b4ed6f45011c624cbc47c25a486576418203f4dd This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18139 Malicious code in dictanovaasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 afc8d83a420096900bdccd11b4ed6f45011c624cbc47c25a486576418203f4dd This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18142 Malicious code in orchestril (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0bda956d0ba9b9905171793e59d4105ec06f8f0aadaa3508b66ad19bdaa10d18 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...