Malicious code in calcnotepad (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 84ad749380bb774a5cc7da818c03f863ee2838773e46e0a5c4cff469e1647962 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

MAL-2024-12215 Malicious code in bestcolorsever (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8335ea2981241d7eb1836338e2a942abf4f5096eb264b0ceb13e85ec435b6465 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

MAL-2024-12314 Malicious code in nirohf-reverse-shell (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c2b0a9ce248bca096b5109a73b943559cabbd6f77433d4a64cd1c804f7ec88df Installing starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

CVE-2024-53865 Python package "zhmcclient" has passwords in clear text in its HMC and API logs

zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: 1. The 'boot-ftp-password' and 'ssc-master-pw' properties when creati...

CVE-2024-53865

CVE-2024-53865 affects the Python package zhmcclient, a client library for IBM Z HMC Web Services API. The issue is that in affected versions, password-like properties are written in clear text to API and HMC logs in several operations: boot-ftp-password and ssc-master-pw when creating/updating p...

CVE-2024-53865 Python package "zhmcclient" has passwords in clear text in its HMC and API logs

zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: 1. The 'boot-ftp-password' and 'ssc-master-pw' properties when creati...

Malicious code in driftme (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4db40025175947d42bcca75bc2f04d0dab05379e9e84108c40de1cda6a854604 Importing the module starts executing a remote script, as well as leaves a persitance in the .bashrc --- Category: MALICIOUS - The campaign has clearly malicio...

Malicious code in pytest-tt-ddriven (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0fc281f8b24ee3d2420a1c1b3815d5c6a9a9420e0baebe4ea975d530181606a0 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

Malicious code in kotlin-stdlib-jdk8 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f217cf2fd34c9cab642b70bd9d778e6ef08a3dfba1954060a29983f2d3e6d47e Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

Malicious code in shoots-flutter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6a612693cb09ca6ca66ccd908b99293ec9ade7b7a719b78f0743332cba338071 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2025-905 Malicious code in byted-df (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 821138aac758315c7a31a463523c4930bdd52e67699199e4c8bda0511c5907f8 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2025-985 Malicious code in shoots-api-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78ebd73df4ce754b9e3a33af932d2b686a05716f83ccf3d7dd99029e73713acc Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

Malicious code in trove4j (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d9c0dbfcd94c11b086cf83f69796c321829bdd64c2ebe53d8f74a72d46e465b0 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2025-960 Malicious code in pytest-tt-ddriven (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0fc281f8b24ee3d2420a1c1b3815d5c6a9a9420e0baebe4ea975d530181606a0 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

Malicious code in shoots-api-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78ebd73df4ce754b9e3a33af932d2b686a05716f83ccf3d7dd99029e73713acc Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2024-12231 Malicious code in ccsinstaller (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3e18cda71c2919c802b866f37fc87002396540fd6d3ea3f22b7703111c247518 Installing package downloads and install an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in dftester-pip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2e23c327cc9243e5437e6b31224c6796b90399065b451269641911b1d1982483 Example package with overwritten install command and the reverse shell --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...

python310-tornado6-6.4.2-1.1 on GA media (moderate)

python310-tornado6-6.4.2-1.1 on GA media Announcement ID: openSUSE-SU-2024:14528-1 Rating: moderate Cross-References: CVE-2024-52804 CVSS scores: CVE-2024-52804 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2024-52804 SUSE : 6.9...

aiocpa 0.1.13 contains credential harvesting code

aiocpa is a user-facing library for generating color gradients of text.Version 0.1.13 introduced obfuscated, malicious code targetingCrypto Pay users, forwarding client credentials to a remote Telegram bot.All versions have been removed from PyPI...

CVE-2024-53899

A flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,integrity and availability of the system. Mitigation Mitigati...