481 matches found
CVE-2025-26411
An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python files to the device. This enables an attacker to gain remote root access to the device. An attacker needs a valid user account on the Wattsense web interface...
CVE-2025-26411
An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python files to the device. This enables an attacker to gain remote root access to the device. An attacker needs a valid user account on the Wattsense web...
MAL-2025-191738 Malicious code in getpublicip (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 041ba7130d1460fe6480d062c61c78db3b88cc5c6d060913d0501fdbdc7c35b0 If installed using source package, the package collects selected environment variables, including GITHUBTOKEN if set, and sends to an external service. The...
Python Malware in Zebo-0.1.0 and Cometlogger-0.1 Found Stealing User Data
Fortinet discovers two malicious Python packages, Zebo-0.1.0 and Cometlogger-0.1, designed to steal data, capture keystrokes, and gain system control. Learn about their malicious behavior and how to protect yourself...
MAL-2024-12372 Malicious code in zip-me (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 4ae48b0e5e3d93cee49e83f0bfa47a43f02ede60914545d0d82204c6664fde6f During installation, the package collects quite extensive information about the host and has no other purpose. To avoid detection, the real code is put in a ZI...
Malicious code in driftme (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 4db40025175947d42bcca75bc2f04d0dab05379e9e84108c40de1cda6a854604 Importing the module starts executing a remote script, as well as leaves a persitance in the .bashrc --- Category: MALICIOUS - The campaign has clearly malicio...
SUSE CVE-2024-50636
PyMOL 2.5.0 contains a vulnerability in its "Run Script" function, which allows the execution of arbitrary Python code embedded within .PYM files. Attackers can craft a malicious .PYM file containing a Python reverse shell payload and exploit the function to achieve Remote Command Execution RCE...
Fabrice Malware on PyPI Has Been Stealing AWS Credentials for 3 Years
The malicious Python package "Fabrice" on PyPI mimics the "Fabric" library to steal AWS credentials, affecting thousands. Learn how…...
Malicious code in byteqs (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d6ca35190c57f806dbb3337e4639f179f6ece665392e5972341cba92767f2747 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...
Malicious code in controlnot-aux (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 a99770ef01fb53c863387ed64967ab6ed42be0cf7c901573dcd472db6ae51091 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...
Malicious code in e3po (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 6e55b96ff3221ade1d2079281a02ab8f0ca735d44a6a00796a24913813b7f8e6 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...
Malicious code in bytedplus-rec (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 60f79f83c8af55853fc5ee2cbcd855f6799c4d5fa43cae98ddf63d0aa5f5fc23 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...
Malicious code in artifact-lab-3-package-9fde789f (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f494a5211d4ea10a131bb54919b6d5e1bf765cea0c3cc018c054e7e304f5856f Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...
MAL-2024-12295 Malicious code in jupihelp (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 7bb124c218cd3a0340ff934eafc0d4c9cbf322b2428d8a868ed28703aeb38426 Once run, downloads and install from sleipnirbrowser.org a suspicious executable pretending to be a webbrowser. This website appears to be a scam using some ki...
Hackers Distributing Malicious Python Packages via Popular Developer Q&A Platform
In yet another sign that threat actors are always looking out for new ways to trick users into downloading malware, it has come to light that the question-and-answer Q&A platform known as Stack Exchange has been abused to direct unsuspecting developers to bogus Python packages capable of draining...
Malicious code in blab111 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 bc1ea66b7bd97f1590f64319f168a1e5ce5f257bf47595de26247cc07a48f80c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
Malicious code in muxf (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 694c32190cb5df1b380a25e3c2235d032724d67bef75b932ed4f59101a5f0e7a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2024-12328 Malicious code in postgresql-connector-python (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 87f55ac62324b5fc631b711e125f897d8ae10d06a9d80173463d9a5fa1915302 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2024-12247 Malicious code in comfyui-node-pkg (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d14c72a2c0a980d7106ed7e451501074521e6282c64d87f689b4b758f877d2ea Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2024-12221 Malicious code in blz-test-package (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 01f2433c1d8bc3c461a9580e06ffcac55e0d5e79ac651f1326c6ddd10114a544 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...