MAL-2025-48903 Malicious code in tronhex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4c2eceb463098204e7a3b3cdce61c4933a4a8b486578f6a3cc64f593ae11e064 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in tronhex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4c2eceb463098204e7a3b3cdce61c4933a4a8b486578f6a3cc64f593ae11e064 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

colander

This is a Python library for deserialization and validation of data structures composed of strings, mappings, and lists. It is a package that can be used to serialize an arbitrary data structure to a data structure composed of strings, mappings, and lists, and to deserialize and validate a data...

MAL-2025-48911 Malicious code in yuzo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 deb22bdfdecb739735dd50a5e0e2fe8329ee260b7236db8112629d7516d081d4 Package contains an infostealer and is clearly prepared for using it. Different versions present different variations, newer are based on CStealer. The...

MAL-2025-48898 Malicious code in suyo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c9b3fe60a21600a82fb46e53eeaf8e62998a5851821b70aac4b31433e79349d4 Package contains an infostealer and is clearly prepared for using it. Different versions present different variations, newer are based on CStealer. The...

Malicious code in suyo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c9b3fe60a21600a82fb46e53eeaf8e62998a5851821b70aac4b31433e79349d4 Package contains an infostealer and is clearly prepared for using it. Different versions present different variations, newer are based on CStealer. The...

MAL-2025-47451 Malicious code in colorinal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security aac66e0b739a7c06226108da151ee90cc6b406fcf287093e3ca4da4f5eebf79e This package is malicious and allows an attack remote code execution on Windows and Linux machines. The package termncolor uses colorinal ...

Malicious code in termncolor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security bdc043b163e4ec6acada5d376a6a7becb3bba51c2b25307833500ec9fd8e1c4f This package is malicious and allows an attack remote code execution on Windows and Linux machines. The package termncolor uses colorinal ...

SilentSync RAT Delivered via Two Malicious PyPI Packages Targeting Python Developers

Cybersecurity researchers have discovered two new malicious packages in the Python Package Index PyPI repository that are designed to deliver a remote access trojan called SilentSync on Windows systems. "SilentSync is capable of remote command execution, file exfiltration, and screen capturing,"...

[SECURITY] Fedora 42 Update: python-pip-24.3.1-5.fc42

pip is a package management system used to install and manage software packag es written in Python. Many packages can be found in the Python Package Index PyPI. pip is a recursive acronym that can stand for either "Pip Installs Packages" or "Pip Installs Python"...

Malicious code in tronkeeppy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 415a91c7ce521e9bd46c6e7343acc641436614a73a056c5663496697e4399825 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2025-48906 Malicious code in tronkeeppy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 415a91c7ce521e9bd46c6e7343acc641436614a73a056c5663496697e4399825 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in tronkeep (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 381d538ed6a0fd0f9b5cd5fbbbd6423bb8f906d8974a297ac4173cf0df0026e9 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in hackerone-app-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7989720a786925f09101ea3e9ebce9bf8190a57a6401b6e46125a75ad160bc66 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-48892 Malicious code in hackerone-app-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7989720a786925f09101ea3e9ebce9bf8190a57a6401b6e46125a75ad160bc66 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-48888 Malicious code in consolergbcolor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 04beefffad3b4018eda21173a10a1dbebd8127bd9870d86e31894c6be592e107 If used, the code attempts to take a photo using the computer's camera and exfiltrates it --- Category: MALICIOUS - The campaign has clearly malicious intent,...

AI-Powered Villager Pen Testing Tool Hits 11,000 PyPI Downloads Amid Abuse Concerns

A new artificial intelligence AI-powered penetration testing tool linked to a China-based company has attracted nearly 11,000 downloads on the Python Package Index PyPI repository, raising concerns that it could be repurposed by cybercriminals for malicious purposes. Dubbed Villager, the framewor...

MAL-2025-47787 Malicious code in mevguard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46b2aa8c02569ef9c6bab8214553d7af8d7e1c1f3499324654bb30870832f6f5 The obfuscated code provides "initializesession" function that exfiltrates the provided argument. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in mevguard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46b2aa8c02569ef9c6bab8214553d7af8d7e1c1f3499324654bb30870832f6f5 The obfuscated code provides "initializesession" function that exfiltrates the provided argument. --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2025-47807 Malicious code in tronkeypy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 15beba1021e7f60daed074087734c4a931b0b0d93695e6d1bf28aea909f41a80 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...