MAL-2025-3464 Malicious code in request-wizard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ff748393cb55e78c43fea879bbd55034152148246aa8d45359cfa8517845e17c Importing the module starts an Infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-09-hyperreq...

Malicious code in colorbytes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 aa4677648d784f5460e80091c656719fc082e6ed9028940b407c97b0e78ff008 Extremely obfuscated code starts when importing the module, and then downloads the next stages and configuration from pastebin. They include a whole range of...

Malicious code in colourfulls (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 735ca3ff38b76e7b11c1f7b884880871427299042e250bb42e17dcf66b8c8e11 Once imported, the module attempts to download an executable, put into Discord directory and most probably trick discord to start it. The download link does no...

MAL-2024-12246 Malicious code in colourfulls (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 735ca3ff38b76e7b11c1f7b884880871427299042e250bb42e17dcf66b8c8e11 Once imported, the module attempts to download an executable, put into Discord directory and most probably trick discord to start it. The download link does no...

Malicious code in coffin-codes-2022 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6c58561bbec76769fed6ea31b26a57f72ff7242de59c7c6f297a14b56f9b547e So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by...

Malicious code in coffin-grave (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21110452950ae0dced9cfd59dd55627b8634f47f3dd2be36558c338437532fac So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by...

Malicious code in coffin-codes-net (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 df624a59b2cb5ef5cf295a7e63718bf7938250f59c5cda19bb6f43c40824e99b So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by...

MAL-2024-12244 Malicious code in coffin-grave (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21110452950ae0dced9cfd59dd55627b8634f47f3dd2be36558c338437532fac So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by...

Malicious code in cobo-custdoy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1bb6da528665b6d869e583cb594f1f0cc7e7ccaf8cc5a7a859c0db9e7fa80c19 It appears to be a forgotten pentest checking typosquatting against cobo-custody package, but may also have malicious purposes. During installation, if a machi...

Malicious code in cobo-python (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2f1c1c4efd134e130c04178382ff3ea318301fb18b5eb6eed696c49cf64e9ad6 It appears to be a forgotten pentest checking typosquatting against cobo-custody package, but may also have malicious purposes. During installation, if a machi...

Malicious code in browser-cookies3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ac253e47b0fa143074f6239c3c84b3ecd3521d37f71c4f92937f53cafc5067b5 Package contains a compiled infostealer that is started instead of promised functionality --- Category: MALICIOUS - The campaign has clearly malicious intent,...

Malicious code in dirutils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c67eead763edc5b56dadc5bfcec545f8799586732b861a6e661050d1165bc7e8 Package contains a compiled infostealer that is started instead of promised functionality --- Category: MALICIOUS - The campaign has clearly malicious intent,...

Malicious code in gmacpyutil (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7522b589abf570f1591bcd3eb29e4a900791d28901d30c5b57f151e899f94839 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in whalebone7-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ebd207a56329855d7d146895e375b39fcbe907f6ff2e7489a80bbe7c6d4a01fc Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in pwnstar-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0b5a94b7cc47cb91bf552abe43f1a0d078ed5c6e668c5ff4caa8c4d9f6d14177 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in babel-preset-current-node-syntax (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 227436e7c8f26da0ff88db12bd9102d85f9f596cf495b6e9192c634d275a5686 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in test-packages1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5c5608702af52a2ca19f0b384036f76248848f4b4ddbe582631d85b3f5e77dca Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in ateslassia (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7b3ae00037330440de3fd0b333720f254e1549b277a12df5d31fb7f70d771daa Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in glob-to-regexp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ce8e1c3de8370811f29db098c2ca6d1fbd027017b5e29a9b540a3dbe8f58c704 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

MAL-2025-929 Malicious code in gmacpyutil (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7522b589abf570f1591bcd3eb29e4a900791d28901d30c5b57f151e899f94839 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...