MAL-2024-11521 Malicious code in akobo (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11515 Malicious code in afriton-py (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11516 Malicious code in afritonpy (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11514 Malicious code in afriton (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11513 Malicious code in afrit-name (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11512 Malicious code in 48484efej8id (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-934 Malicious code in huggingleg2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 19ba00b8fab08e8016af3bfb4ba9fbb18510b2aa823dfb82a46a5b3ecd477655 Installing the package starts a revshell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-12-huggingleg2...

MAL-2024-12309 Malicious code in my-service-manager (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 58c8e4c726cef11c6d7d60916210f532060a6ff7a98bb7fea5872eb10335dd5d While the package appears to be a manager for Windows service, the linked executable is an infostealer with capabilities like cookie stealing ang keylogger. Th...

MAL-2025-913 Malicious code in datagov-harvester (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd1508013c2ef9abe7de7e4eb3bbdc492b545c3344ae4148b4e06165e8313229 The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-900 Malicious code in apache-airflow-providers-edge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a9db9c9532f0405358d9eba42b9f1e7702f9d5f1878e60e1d6e0d94f7154368b The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-902 Malicious code in bancor-simulation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8e9ecf6b613a42c070932a842fc4ebe81508d28adbb0aecee9aebe4e530acc0a The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-912 Malicious code in crowdstrike-foundry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 89a436ce955b3eb01df1e23a27f7b9d0091b3720818f31559038c7af44bca276 The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-987 Malicious code in shoots-flutter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6a612693cb09ca6ca66ccd908b99293ec9ade7b7a719b78f0743332cba338071 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2025-998 Malicious code in trove4j (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d9c0dbfcd94c11b086cf83f69796c321829bdd64c2ebe53d8f74a72d46e465b0 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2024-11575 Malicious code in dftester-pip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2e23c327cc9243e5437e6b31224c6796b90399065b451269641911b1d1982483 Example package with overwritten install command and the reverse shell --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...

GHSA-486G-47CC-8WXF aiocpa contains credential harvesting code

aiocpa is a user-facing library for generating color gradients of text. Version 0.1.13 introduced obfuscated, malicious code targeting Crypto Pay users, forwarding client credentials to a remote Telegram bot. All versions have been removed from PyPI...

aiocpa contains credential harvesting code

aiocpa is a user-facing library for generating color gradients of text. Version 0.1.13 introduced obfuscated, malicious code targeting Crypto Pay users, forwarding client credentials to a remote Telegram bot. All versions have been removed from PyPI...

PYSEC-2024-152 aiocpa 0.1.13 contains credential harvesting code

aiocpa is a user-facing library for generating color gradients of text. Version 0.1.13 introduced obfuscated, malicious code targeting Crypto Pay users, forwarding client credentials to a remote Telegram bot. All versions have been removed from PyPI...

PT-2024-40067 · Pypi · Aiocpa

Name of the Vulnerable Software and Affected Versions: aiocpa versions prior to the removal from PyPI Description: The issue concerns a user-facing library used for generating color gradients of text, which introduced malicious code in version 0.1.13. This malicious code targets Crypto Pay users ...

PT-2024-40899 · Pypi · Aiocpa

Name of the Vulnerable Software and Affected Versions: aiocpa versions prior to the removal from PyPI Description: The issue concerns a user-facing library used for generating color gradients of text. It was discovered that version 0.1.13 introduced obfuscated, malicious code. This code targets...