Malicious code in zebo (PyPI)

Source: kam193 27f62f0f9a2a11b03c5bbead202d9f5d58ca471041e3115eb67dd88accc22be4 Package automatically installs a script with keylogger and screenshots extraction, and sets it for an autostart. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in yt-api-dlp (PyPI)

Source: amazon-inspector d4710e1aa4fe025aaed51f4958f3b514a6cb950b40069f424c7a5d9a2f85591c Package name yt-api-dlp is a single-token insertion away from the widely-used yt-dlp package, and the tarball contains a near-verbatim copy of the yt-dlp source tree version 2026.06.09, internal...

Malicious code in testjsonn1 (PyPI)

Source: kam193 d8b57f71eadeb645df871ae41a475cb9a8ba647679e7455f66e0c9e9b5627651 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-ronnyfredd-exfiltr-clipboard Reasons based on the campaign: - peristence-autorun - clipboard-stealing - Source:...

Malicious code in testjson3 (PyPI)

Source: kam193 783bce620b6d82880784734f95e5e48217bdc056277d57781a45fb14b66bcb97 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-ronnyfredd-exfiltr-clipboard Reasons based on the campaign: - peristence-autorun - clipboard-stealing - Source:...

Malicious code in telepycore (PyPI)

Source: kam193 c3dcd0a2a8162a703ef9d7b90566e4c55116a7f4f4d3b8759ca0d2640acd4ee4 Package can only be used requires additional triggering to install a remote executable, ensure it starts on logon and name mimic network service. Though different versions contain different executables, they are mostl...

Malicious code in robloxextra (PyPI)

Source: kam193 d4281a22f488970ba086ca475848dedc3db41f77d760a4c280356d1018480ccf Importing the module starts downloading multiple stages of obfuscated code, that e.g. adds itself to autostart. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in requeszs (PyPI)

Source: kam193 d8c95a5f64dd212c781d6b3c45eb03f38bcf5220f688c4d903e9bfca20911b62 Importing the module downloads and starts an infostealer attempting to exfiltrate data and establishing persistence through autorun directory. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in reqiest (PyPI)

Source: kam193 ae04fab0eca7fc7fee7494d9651df8a18dbe919cd8c0fa56522711b9f845aa25 Importing the module downloads and starts an infostealer attempting to exfiltrate data and establishing persistence through autorun directory. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in pulsecord (PyPI)

Source: kam193 025d4e33a2037fb9ad36cb4b08b122e4439bb4932b73ac6c6f403609e7e1c09e This package is prepared for silent execution of a malicious executable, with disabling AV protection. While there is no link to the malicious binary inside, the package shares clear indicators of being part of the...

Malicious code in netspear (PyPI)

Source: kam193 015d4e7a345166ce5767408055a810a394e59a8c40b1a3c459ee006efa647e0a Code download and runs an executable, which is widely recognized as malware. The system is also configured to run it on startup, and the file is saved in paths attempting to look as a system file. --- Category:...

Malicious code in netpackat (PyPI)

Source: kam193 f0f971eaa8aa4f59d981802034020fcd9b7c6008c2e9ed41a868a9e3186e7eed Code download and runs an executable, which is widely recognized as malware. The system is also configured to run it on startup, and the file is saved in paths attempting to look as a system file. --- Category:...

Malicious code in myproject-bola (PyPI)

Source: kam193 f85bf2df7a8a311b7140ca4086746ecf3c26b219843b96c1f9f8c22f505e7edc Starting the module initiates an infostealer with a Telegram bot and RAT-like functionality and hardcoded credentials. The code automatically adds itself to autostart, collects some credentials, and also awaits furthe...

Malicious code in multithreadedexecution (PyPI)

Source: kam193 3248950b032e1381ddc79d43dfdba8fb6dccce4b1afafd5825e560d793b3bd09 Once run, package downloads and installs an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-discord-selfsbotsx Reasons based on the campaign: -...

Malicious code in maxload (PyPI)

Source: kam193 09b392bd35def14bcd622e3863dec62ba92d26ef152cc81e657cb2c2194b93a8 Running the module downloads, configure its startup and starts a remote executable. The exe is capable of sending files to a hardcoded Telegram channel, but this behavior seems not to be triggered during analysis ---...

Malicious code in jsonconfig-utils (PyPI)

Source: kam193 883897a307b53ac17e981eac46b8d6f8c31d88fc2628c6d57c5f7f191ed84b81 During installation, package installs a script that listens for remote commands and executes them. The script is also added to autostart configuration and disguised as system application --- Category: MALICIOUS - The...

Malicious code in isb (PyPI)

Source: kam193 93750cbddba7897fde1d31836971e11082ad2076012c7caf708980de45827840 Starting the module initiates an infostealer with a Telegram bot and RAT-like functionality and hardcoded credentials. The code automatically adds itself to autostart, collects some credentials, and also awaits furthe...

Malicious code in gentorqkkh1 (PyPI)

Source: kam193 23c1a7041a4424ef67ce4e182aee3ead70dc15aacd94d20d63b5f7028224d75c --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-ronnyfredd-exfiltr-clipboard Reasons based on the campaign: - peristence-autorun - clipboard-stealing - ---...

Malicious code in fastercoding (PyPI)

Source: amazon-inspector 1c302e448868fcff3110a45d20b53d9d887cfb5aa31bb66df90702f2767246b4 The package exposes a single public function run re-exported from init.py which, on Windows, downloads BackgroundSyncService.exe from...

Malicious code in fastercode (PyPI)

Source: amazon-inspector 14de4534d4cf2290f5f54bc5929fa799b73dff2e6a03aa879ade141dfc6ea054 The package advertises itself as a Python performance helper "Make your Python code run faster" and exposes a single public function run. On Windows, calling run fetches BackgroundSyncService.exe from...

Malicious code in dzuseragents (PyPI)

Source: kam193 f0be670ad8e17f42129943a744559ebb8818c581bc637c1469cf8553b7b8f8c9 The package downloads an executable and adds it to autostart. The downloaded application then periodically creates a screenshot and sends it to a Discord channel, as well as waits for further instructions --- Category...