Malicious code in set7 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8e2e9040a08a54eb2600701e50e4137fd9959873e23cb5c6c4845e0a4f3f6564 Package downloads and suggest opening an obfuscated script, which is an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2025-41760 Malicious code in set7 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8e2e9040a08a54eb2600701e50e4137fd9959873e23cb5c6c4845e0a4f3f6564 Package downloads and suggest opening an obfuscated script, which is an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2025-191683 Malicious code in aphorism-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 95f15b2b497431703ff51667a4055e8172f9202aeeea0f725b0b0550812f3299 Importing the module starts a telegram bot that connects to a chat and executes provided commands --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2025-191885 Malicious code in talbat (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa560ce194b853d26b02cc7a6fc99298c2b1de4516a8beb84b84475aa1fb23b3 Importing the module starts a telegram bot that connects to a chat and executes provided commands --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in rbx1325382 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 966cc45844a609edfa292523c993aa173d39c710d8856c06f30d5d73d82f48e9 During installation, package attempts to exfiltrate browser data --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-41735 Malicious code in rbx1325382 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 966cc45844a609edfa292523c993aa173d39c710d8856c06f30d5d73d82f48e9 During installation, package attempts to exfiltrate browser data --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-41734 Malicious code in rbx1325 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7895e3c185d37126abdb72411a2b02b7d78325ca51e4cecd4303e282608b8966 During installation, package attempts to exfiltrate browser data --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in rbx1325 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7895e3c185d37126abdb72411a2b02b7d78325ca51e4cecd4303e282608b8966 During installation, package attempts to exfiltrate browser data --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in svcmanager (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 062d589e7c49394864a13694f3de2a89589fd2f5e6a4d2e43e35ce136b6e7e9c Package attempts to download an executable and install it as a privileged service. The executable seems to be modified remote access tool --- Category: MALICIO...

MAL-2025-191685 Malicious code in avatar-handler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c3750cf8fac7fc22334d1fb416e7f3af691425c669829dcc9857abdc1384bbb7 Code pretending to handling downloading an image, but in fact is prepared to download and execute a Powershell script image properties. No known usage ---...

Malicious code in memorylib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 be3ea3afb3553f67411c8bebff9d99282169997e212b5ee1dd14505d1612d551 Installing the package triggers a code that looks like downloading a picture, but in fact downloads and starts an executable with malware. Note that file...

Malicious code in memtools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fafb3bba871c43e80681f3c9f4618ec7547fe2295b120eb93adf31a59bf021f3 Installing the package triggers a code that looks like downloading a picture, but in fact downloads and starts an executable with malware. Note that file...

Malicious code in vramx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 62a5bfc96a523ea6df6a2539bea5f16b48800c1896ef7fb2df344ed0486e6a49 Installing the package triggers a code that looks like downloading a picture, but in fact downloads and starts an executable with malware. Note that file...

MAL-2025-6547 Malicious code in memlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a0d0e362d3ea9b768078a9e47f80c667acef799c7099f8044e74fd1738fdedb4 Installing the package triggers a code that looks like downloading a picture, but in fact downloads and starts an executable with malware. Note that file...

Malicious code in memlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a0d0e362d3ea9b768078a9e47f80c667acef799c7099f8044e74fd1738fdedb4 Installing the package triggers a code that looks like downloading a picture, but in fact downloads and starts an executable with malware. Note that file...

Malicious code in iscc-flag (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cb80cd1cd16dd0ba2beb2e560000380b1eb3cb60d947ed49d5ce9bfb4b12008f Installing starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-anku2-rce Reasons...

Malicious code in anku1-rce (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 49fbe573576f7a8b2de883e6b11d60e3df40ffb8db7d62ba7f5d76a06ef4900c Installing starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-anku2-rce Reasons...

MAL-2025-6433 Malicious code in anku2-rce (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4a0fdfa7bc3195d177e4d6e3dcad16eb59cc436e2b4dc48230b0c088546086fe Installing starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-anku2-rce Reasons...

Malicious code in crto0 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8bdcf6d997fa4676ca2da647171f21e944f9b7d0f34010e6ea8da42364a2d03d Importing the module starts downloading or decrypting, and then executing an executable being a wide recognized malware/Infostealer Redline family --- Category...

Malicious code in crto5 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3a906f74f9672d68f42311985b67b1076e3b02caf14d8366b703d3331ff5897b Importing the module starts downloading or decrypting, and then executing an executable being a wide recognized malware/Infostealer Redline family --- Category...