MAL-2025-6542 Malicious code in malimaloo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cfbfc14d4873b047e472e26b760198ecc402eb1ed35d59ab3ace8dc31936690f The only goal of the package is to execute a webhook or a suspicious file during installation. Closely related to 2025-07-0x9xnx - created after previous...

Malicious code in malimaloo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cfbfc14d4873b047e472e26b760198ecc402eb1ed35d59ab3ace8dc31936690f The only goal of the package is to execute a webhook or a suspicious file during installation. Closely related to 2025-07-0x9xnx - created after previous...

Malicious code in malinssx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ec1d3e0940a3c37917b528689547d3728f9f3d0b9e408acc7dcc67435c09d2b0 The only goal of the package is to execute a webhook or a suspicious file during installation. Closely related to 2025-07-0x9xnx - created after previous...

Malicious code in hellotesthim (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a7a4369b02deb0d2a9cf1340be0efe760e29f7979e3f7361ba029a282b70597f Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...

Malicious code in malipkghehe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7d87e6aa802f74ebffe0dd2741a513b40db41629d41828bf5b9847ca87e7609e Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...

MAL-2025-6544 Malicious code in malipkghehe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7d87e6aa802f74ebffe0dd2741a513b40db41629d41828bf5b9847ca87e7609e Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...

MAL-2025-191733 Malicious code in fonafx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9441463f029726ea263225e9b0092d82b049e2d7a4e059becd24f5e23c70a906 Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...

Malicious code in rehttps (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 08172961784989f62b2b0793fa7686e1c25883883f790293df61591aa2fc6940 During installation, package attempts to download and starts an executable. The package itself is a clone of requests --- Category: MALICIOUS - The campaign ha...

Malicious code in walletutility (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b2977792a67d074770c5080ac055addab8c5bf6b77bf203132fb2c67f32091a6 Package silently exfiltrates the provided mnemonic --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in walletsdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 24b8f8046f66b9996b1f2169f1034b1c35f0760e09d4e91e712d0b3a36a88d6e Package silently exfiltrates the provided mnemonic --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in wallet-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c83a3acdf0b02acc2a9af7cf885f2f744a154847edc66e1264ee1c38d8d7b984 Package silently exfiltrates the provided mnemonic --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in walletsutils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 98651db61cea6613aac5b784cf567a82461f39c8cfa2c7634504ea2708989408 Package silently exfiltrates the provided mnemonic --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2025-6613 Malicious code in utilswallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 587ebf505d5385c1a6f9034ff8ede5f52b9f7f31ad154261c0f5a289af62a33d Package silently exfiltrates the provided mnemonic --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in utilswallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 587ebf505d5385c1a6f9034ff8ede5f52b9f7f31ad154261c0f5a289af62a33d Package silently exfiltrates the provided mnemonic --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in cpan (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e70433969aea3c8283f99098b25b8a598f427b5fd451e9bfd5bc46098704bfb2 Installing the package starts a revshell and download and starts a remote script depending on version, different malicious functionality. The name seems to...

Malicious code in managment (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 754c9b609bb8dafc0fd21d141cd216744d9f2aa1f23898990c52e872fdc23e1a Installing the package starts a revshell and download and starts a remote script depending on version, different malicious functionality. The name seems to...

Malicious code in sqiul83 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 67d309c2d4c740426c07cc17768f6313eebd765242e7e4a63aa04213d21358ea During installation of the source package, it attempts to silently download and start a remote executable. At the time of analysis, the downloading link did no...

Malicious code in mainx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6a77aad2f42165ec9582f04fffab948f6a1125564e34f4d09c8d089b2708d8d2 While described as educational package to simulate post-exploitation environment, the malware is active and once started, automatically attempts to exfiltrate...

MAL-2025-6540 Malicious code in mainx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6a77aad2f42165ec9582f04fffab948f6a1125564e34f4d09c8d089b2708d8d2 While described as educational package to simulate post-exploitation environment, the malware is active and once started, automatically attempts to exfiltrate...

MAL-2025-6477 Malicious code in chatgpt4 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6a2f99d20569358bdeab51db7e4f6ea0348c87bbf832a7bc244581a472a05072 Importing the module starts shell code execution --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...