MAL-2025-5174 Malicious code in worldhello (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c09616d1a3cf63c69efe5b81863fee024898fd16025a96efa3e70504012bb6bd The OpenSSF Package Analysis project identified 'worldhello' @ 1.0.0 pypi as malicious. It is considered malicious because: - The package execut...

MAL-2025-6598 Malicious code in syscachelib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c8aa87f03342830d082dcfd87dfce0528b19781902f9c9e56a7379046d8a1572 Importing the module starts a UAC bypass through fodhelper to run a privileged shell, and download and execute a remote file. --- Category: MALICIOUS - The...

PyPI, npm, and AI Tools Exploited in Malware Surge Targeting DevOps and Cloud Environments

Cybersecurity researchers from SafeDep and Veracode detailed a number of malware-laced npm packages that are designed to execute remote code and download additional payloads. The packages in question are listed below - eslint-config-airbnb-compat 676 Downloads ts-runtime-compat-check 1,588...

MAL-2025-6469 Malicious code in browser-history-analysis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 032a326beadf36ce66d29555a7dacc90d6dfc733435dc61852cbc1e5128ee73d When starting the server with expected functionality with potentially sensitive content, the package silently sends the location external IP to a remote...

MAL-2025-6531 Malicious code in justanything (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 206471fdab67d7afeeb5fa6ee55cdb14b88338b58b50a5b73f31bbbb5e66e65b Code is designed to download and run remote scripts during installation, which finally downloads and starts an infostealer --- Category: MALICIOUS - The campai...

MAL-2025-6496 Malicious code in doverius (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c386579381491132baf4d7848ddb82f965c540fb732abb69771325665eabbc63 Code is designed to download and run remote scripts during installation, which finally downloads and starts an infostealer --- Category: MALICIOUS - The campai...

MAL-2025-191934 Malicious code in win32evtlogutil (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5d62d03c43564c8087172222e65beaf334bd9f219291eb6c36a142ad88adef4f Research packages targeting typosquatting and dependency confusions, without really harmful behaviour - just calling home through DNS resolver. Related to...

MAL-2025-6552 Malicious code in my-fun-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6642f3653e49e0a80b7fadf4c06bc64cba8a1a359772f1c7a668888278348fd6 During installation, the obfuscated code attempts to insert a modified Python DLL and runs a code. --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2025-6578 Malicious code in robloxextra (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d4281a22f488970ba086ca475848dedc3db41f77d760a4c280356d1018480ccf Importing the module starts downloading multiple stages of obfuscated code, that e.g. adds itself to autostart. --- Category: MALICIOUS - The campaign has...

MAL-2025-191879 Malicious code in stubsout (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 288961ef642901bbbd1ecf1fee45702985e9691d3f2fdc95f5990a197df2782b While described as telemetry, importing the package attempts to send out some basic info as well as quite sensitive environmental variables. --- Category:...

MAL-2025-6457 Malicious code in atlasctf-21-prod-20 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ffe859775c26074cc4af620ba898f558fb64310ff0cd6ac1cb212700fadcb182 On installation or importing, the package attempts to exfiltrate some basic information, e.g. /etc/passwd --- Category: PROBABLYPENTEST - Packages looking like...

MAL-2025-6454 Malicious code in atlasctf-21-prod-17 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0ae7f72936fae89a02869e537528e165a62538cbfdd9d4a441cdcdbd316783da On installation or importing, the package attempts to exfiltrate some basic information, e.g. /etc/passwd --- Category: PROBABLYPENTEST - Packages looking like...

MAL-2025-6450 Malicious code in atlasctf-21-prod-13 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 773b90b87addef84f41e3bec0ed50198f5217f97c58686c8700726e2c5911f39 On installation or importing, the package attempts to exfiltrate some basic information, e.g. /etc/passwd --- Category: PROBABLYPENTEST - Packages looking like...

MAL-2025-6439 Malicious code in atlasctf-21-prod-02 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 797236959adb77b5a2b6d687ba0dcd688ea1fff675136998f38fedc01c65fa89 On installation or importing, the package attempts to exfiltrate some basic information, e.g. /etc/passwd --- Category: PROBABLYPENTEST - Packages looking like...

MAL-2025-6458 Malicious code in atlasctf-21-prod-21 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 79c8505b253779798971bd98108a76e3e9ba4a7a590fa35b73eef9782c70616d On installation or importing, the package attempts to exfiltrate some basic information, e.g. /etc/passwd --- Category: PROBABLYPENTEST - Packages looking like...

MAL-2025-6443 Malicious code in atlasctf-21-prod-06 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 40700739340f4f0bb3e0439a94754cb868827b002cad84a1dfca90da1dfa032d On installation or importing, the package attempts to exfiltrate some basic information, e.g. /etc/passwd --- Category: PROBABLYPENTEST - Packages looking like...

MAL-2025-6437 Malicious code in atlasctf-21-prod-00 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 14e4ae78e884590292b3a8ef6ebe2093e02ffc05d89f37718d9f2573e8a9e5e0 On installation or importing, the package attempts to exfiltrate some basic information, e.g. /etc/passwd --- Category: PROBABLYPENTEST - Packages looking like...

MAL-2025-6442 Malicious code in atlasctf-21-prod-05 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7e008f819b27019b178836f9edea97e159c3c1f765d391800ea99f06a26ce20a On installation or importing, the package attempts to exfiltrate some basic information, e.g. /etc/passwd --- Category: PROBABLYPENTEST - Packages looking like...

MAL-2025-6453 Malicious code in atlasctf-21-prod-16 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 57c6acfcb3c6bb659cac9b311e2cc25e72f3ab57d80e3403b70b7e05a2a06ed9 On installation or importing, the package attempts to exfiltrate some basic information, e.g. /etc/passwd --- Category: PROBABLYPENTEST - Packages looking like...

MAL-2025-6438 Malicious code in atlasctf-21-prod-01 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 258b21be0ec08a121a4b506eb1cc9409d08b0cfecc9a2b995181dee57254afc7 On installation or importing, the package attempts to exfiltrate some basic information, e.g. /etc/passwd --- Category: PROBABLYPENTEST - Packages looking like...