CVE-2024-53899

A flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,integrity and availability of the system. Mitigation Mitigati...

PyPI Python Library "aiocpa" Found Exfiltrating Crypto Keys via Telegram Bot

The administrators of the Python Package Index PyPI repository have quarantined the package "aiocpa " following a new update that included malicious code to exfiltrate private keys via Telegram. The package in question is described as a synchronous and asynchronous Crypto Pay API client. The...

Malicious code in cometlogger (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 627a435be86fedd2eccd2f0af61fa8b19c8c12dd781fc1bdc064d836e1eff19a Multi-purpose infostealer, including grabbing cookies, files, information from cryptowallets; injecting code into discord application. This package is a builde...

Malicious code in newpipv3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 54fac2a807bae6742d82c86f55d97a1b4a810e42ee3b0b9dcb0c981c36ab712d The OpenSSF Package Analysis project identified 'newpipv3' @ 0.1.0 pypi as malicious. It is considered malicious because: - The package...

PyPI Attack: ChatGPT, Claude Impersonators Deliver JarkaStealer via Python Libraries

Cybersecurity researchers have discovered two malicious packages uploaded to the Python Package Index PyPI repository that impersonated popular artificial intelligence AI models like OpenAI ChatGPT and Anthropic Claude to deliver an information stealer called JarkaStealer. The packages, named...

Malicious code in blackamerxs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 50486a7fa5636706a3c90bf515f6664c6cbb11aa127f9b3e95d7b38cf89c80c8 If run, the code in the package exfiltrates all files from the current directory tree. --- Category: MALICIOUS - The campaign has clearly malicious intent, lik...

acia (>=0.3.0, <=0.3.2), ai-parrot (>=0.22.0, <=0.24.0) +235 more potentially affected by CVE-2024-30896 via influxdb-client (>=1.3.0, <=1.50.0)

influxdb-client PYPI version =1.3.0, =0.3.0, =0.22.0, =0.0.7, =1.0.0rc1, =0.1.0, =1.0.8, =0.0.1, =0.1.6, =0.1.0a1, =1.0.37, =0.1.0, =0.5.0, =0.12.0, =1.6.0b0, =20.0.0.0rc1, =24.0.0 and more Source cves: CVE-2024-30896 Source advisory: SNYK:PYTHON-INFLUXDBCLIENT-8422793...

Pyload Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/stopwatch' class MetasploitModule 'Pyload RCE CVE-2024-39205 with js2py sandbox escape CVE-2024-28397', 'Description' = %q CVE-2024-28397 is sandbox escape ...

Malicious code in random-security-test-pkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8d5e8dadc66c780e3fc3351cf55a305fe623b46a48e96847a7da95ea0e5ec211 During installation, the obfuscated code attempts to exfiltrate basic information about the host. There is no other purpose of the package --- Category:...

MAL-2024-12291 Malicious code in instacart-roulette-daemon-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a3b808e86bd3e62945973ac3b25e0f07437a3031a13b6dd2a0567eba90a63821 During installation, the obfuscated code attempts to exfiltrate basic information about the host. There is no other purpose of the package --- Category:...

Malicious code in zebo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 27f62f0f9a2a11b03c5bbead202d9f5d58ca471041e3115eb67dd88accc22be4 Package automatically installs a script with keylogger and screenshots extraction, and sets it for an autostart. --- Category: MALICIOUS - The campaign has...

MAL-2024-11751 Malicious code in zebo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 27f62f0f9a2a11b03c5bbead202d9f5d58ca471041e3115eb67dd88accc22be4 Package automatically installs a script with keylogger and screenshots extraction, and sets it for an autostart. --- Category: MALICIOUS - The campaign has...

MAL-2024-11668 Malicious code in pycalculater (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 84e239de4d2d6d9652a78ead4c1ebb6b3f4952aeb54dc51dc30765eaaf806368 During installation, a remote, obfuscated executable is downloaded and started. The executable at least disables automated updates, malware protection and othe...

Malicious code in discconnect (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd96a216a1790b73568af638b97003c7abd1f502c962137cd1084fb48ebcca64 During installation, a remote, obfuscated executable is downloaded and started. The executable at least disables automated updates, malware protection and othe...

Malicious code in pycalculater (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 84e239de4d2d6d9652a78ead4c1ebb6b3f4952aeb54dc51dc30765eaaf806368 During installation, a remote, obfuscated executable is downloaded and started. The executable at least disables automated updates, malware protection and othe...

MAL-2024-11576 Malicious code in discconnect (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd96a216a1790b73568af638b97003c7abd1f502c962137cd1084fb48ebcca64 During installation, a remote, obfuscated executable is downloaded and started. The executable at least disables automated updates, malware protection and othe...

Malicious code in reverse434343 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9107d563a329f12fdff39bb22f6d6593f6d005d38f9738c2d3a78c94ee368262 The package contains only a reverse shell started on installation --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in reverse4343 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a90c21a3dc6b4091f1ccd6f17c99b1ec955954d2b78e93029e63c33f12ed3c7d The package contains only a reverse shell started on installation --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2024-11694 Malicious code in reverse434343 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9107d563a329f12fdff39bb22f6d6593f6d005d38f9738c2d3a78c94ee368262 The package contains only a reverse shell started on installation --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in eosio-signer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 647b75de784ff7b23edb8a5b76d1a017b02d1fd719c6a5a92587fa8d89c25abf Installing the package exfiltrates basic data about the system --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anythin...