Malicious code in cryptozip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 157ea6b1f1c3d4ed5564c494db770e9156f3e269f12cefec6e4270085a762f26 During initialization of the archive-support class, the package starts code from another file and downloads multi-stage malware --- Category: MALICIOUS - The...

Android Malware Operations Merge Droppers, SMS Theft, and RAT Capabilities at Scale

Threat actors have been observed leveraging malicious dropper apps masquerading as legitimate applications to deliver an Android SMS stealer dubbed Wonderland in mobile attacks targeting users in Uzbekistan. "Previously, users received 'pure' Trojan APKs that acted as malware immediately upon...

Malicious code in hidden-powershell-runner-ax7 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5785c01837ec1727b89125cf1a3fec3ad941c4ff0b1246d8d16fec1dff53223a Importing the module downloads and starts remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2025-192659 Malicious code in hidden-powershell-runner-ax7 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5785c01837ec1727b89125cf1a3fec3ad941c4ff0b1246d8d16fec1dff53223a Importing the module downloads and starts remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2025-192436 Malicious code in jsonschema-utf8 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 61bf4fa82a7c398e580d547d641bc19e3b16ba446191da04f39dcf9cf9a41eab Package clones a popular package loguru, jsonschema, .... While it claims to have some additional features, the real change is an added compiled native library...

MAL-2025-192435 Malicious code in loguru-utf8 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e20933ac001bbe12fd7962f9e12208f3224c836f3deba7669a649165232e0b78 Package clones a popular package loguru, jsonschema, .... While it claims to have some additional features, the real change is an added compiled native library...

MAL-2025-192365 Malicious code in python-tg-bot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5397ab6595b8237172e9a49952d092803e03526e3dda8277c64dc4d26ae45ff2 During importing, a dependency with infostealer is loaded and package attempts to exfiltrate credentials. --- Category: MALICIOUS - The campaign has clearly...

MAL-2025-191830 Malicious code in pulsecord (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 025d4e33a2037fb9ad36cb4b08b122e4439bb4932b73ac6c6f403609e7e1c09e This package is prepared for silent execution of a malicious executable, with disabling AV protection. While there is no link to the malicious binary inside, t...

MAL-2025-186023 Malicious code in castor-janus-interferometry-asteroid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7debb1be3eb6e3754c95e06a59277a15e5eb6748a6e5d8a27a83589bac84d37 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in html-webpack-plugin-multiverse-proteomics-blackhole (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f04dd975db833fdc723e01450c24356d92668375df821a448e8323c02bf11fd6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in planetology-neptune-bellatrix-on (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78f2b23e9b8a39df059205b517a8ab6243a9cc96f26b1be0aa2c2639737a9919 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181730 Malicious code in astam-ifut-dugoa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9958076d5ca6fd49450da63ab0c0e014c84edd28c17957d627f08a68d8b28773 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-180149 Malicious code in teate-thy-sonic-ajde (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d96952d5f948f72b7e674d6cd2852de6a7fc95bec7443edabe4df5f23bc82782 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rintono-poke81 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 247c46fed48d8d99726ed87a0351468afd7680a2541a8bcbc6d92b28e9f9f727 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-177595 Malicious code in polymer-af-rod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27c822c670493ea25f440e6eaf47abd8f51bc885dbb196b2e56a190f39e532b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in riyanto-poke76 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c61f3951b52eb5f3ba68a4710fc9c84fc9cae8610a81714042b8c4ddae8da3e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aiboa-molipe-amuaaiuai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64ee4b66724df25a49882334d10db950147d415cb0f6383bce94d028500bf264 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lookingan-namala69 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48121a92bca23952347604e76623568efd9ba3c104b44be52184aaf5c35f566e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-157969 Malicious code in lala-poke44 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd8469188539e0da53669ab232a3c4fa1aac4b085fb507928a43fbff6fac4f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158752 Malicious code in lookingan-namala40 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7757fca789d6b212925aeb32b6cc47f48ae06b1f360e6f11232946a92cee7a5a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...