MAL-2025-3464 Malicious code in request-wizard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ff748393cb55e78c43fea879bbd55034152148246aa8d45359cfa8517845e17c Importing the module starts an Infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-09-hyperreq...

Malicious code in colorbytes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 aa4677648d784f5460e80091c656719fc082e6ed9028940b407c97b0e78ff008 Extremely obfuscated code starts when importing the module, and then downloads the next stages and configuration from pastebin. They include a whole range of...

Malicious code in coffin-codes-2022 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6c58561bbec76769fed6ea31b26a57f72ff7242de59c7c6f297a14b56f9b547e So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by...

Malicious code in coffin-codes-net (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 df624a59b2cb5ef5cf295a7e63718bf7938250f59c5cda19bb6f43c40824e99b So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by...

Malicious code in dirutils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c67eead763edc5b56dadc5bfcec545f8799586732b861a6e661050d1165bc7e8 Package contains a compiled infostealer that is started instead of promised functionality --- Category: MALICIOUS - The campaign has clearly malicious intent,...

Malicious code in gmacpyutil (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7522b589abf570f1591bcd3eb29e4a900791d28901d30c5b57f151e899f94839 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in gwinpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fdd3f3646435d9d7857a19999ffa38cdb99c04b4aa62177b1df6f2710b5412b3 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in mlc-llm-nightly (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bdf6d47b319cb60e32a6f2942beaa54bfe6ccc01bb72a8337f062746d49ace38 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in ateslassia (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7b3ae00037330440de3fd0b333720f254e1549b277a12df5d31fb7f70d771daa Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in pwnstar-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0b5a94b7cc47cb91bf552abe43f1a0d078ed5c6e668c5ff4caa8c4d9f6d14177 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in test-packages1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5c5608702af52a2ca19f0b384036f76248848f4b4ddbe582631d85b3f5e77dca Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

MAL-2024-12329 Malicious code in pwnstar-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0b5a94b7cc47cb91bf552abe43f1a0d078ed5c6e668c5ff4caa8c4d9f6d14177 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

MAL-2025-929 Malicious code in gmacpyutil (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7522b589abf570f1591bcd3eb29e4a900791d28901d30c5b57f151e899f94839 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

MAL-2025-6436 Malicious code in ateslassia (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7b3ae00037330440de3fd0b333720f254e1549b277a12df5d31fb7f70d771daa Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in pyadd (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 67e5e3d0aff485ca2bf6f83151e1ecfae4a9b9335db657c72142ac9fd034250e Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in dahood (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b9cc2a4186b5ad68e11dc68aa719583b8f3a746c9f13b8b3b950f9653df0e909 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in roinject (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 abe077384854dc3572befe16d9f41d68fec2a7dbbc8d38884c526bacf0447318 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in cblines (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 80531e39cd96b75b32c7549840f7bc6984377765d9f9f663c0b560332b4e1b84 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in pycblines (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 003ff4ad180c7d33db185b8c29ceca2689909864b5e36c450eb8125290365f99 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in pykane (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5f0e00230ef4f47cbb9d43ffd849aa41f1e4f8b192944f56fdd49e6e24e6dc8d Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...