Malicious code in pyfiglets (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 66caa962e9fedf67dff7c9da840c4a4dcdca71f237d2e36f332f5b5bd32750bc Malicious clone of pyfiglet. Importing the package starts a series of downloading and executing of obfuscated malicious scripts, partially identified by AVs. -...

Malicious code in myownpyfiglet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 feb59db3efc9397070b6fcdf08762e0defb77d34e5ababf463e3c1a7a1f5b927 Malicious clone of pyfiglet. Importing the package starts a series of downloading and executing of obfuscated malicious scripts, partially identified by AVs. -...

MAL-2025-5130 Malicious code in rich-figlet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b97458c87c8580a9cb2f2edc0af2ae40a36489dafa860102eee0307256cb416b Malicious clone of pyfiglet. Importing the package starts a series of downloading and executing of obfuscated malicious scripts, partially identified by AVs. -...

Malicious code in netpackat (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f0f971eaa8aa4f59d981802034020fcd9b7c6008c2e9ed41a868a9e3186e7eed Code download and runs an executable, which is widely recognized as malware. The system is also configured to run it on startup, and the file is saved in paths...

MAL-2025-5121 Malicious code in netspear (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 015d4e7a345166ce5767408055a810a394e59a8c40b1a3c459ee006efa647e0a Code download and runs an executable, which is widely recognized as malware. The system is also configured to run it on startup, and the file is saved in paths...

Malicious code in netspear (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 015d4e7a345166ce5767408055a810a394e59a8c40b1a3c459ee006efa647e0a Code download and runs an executable, which is widely recognized as malware. The system is also configured to run it on startup, and the file is saved in paths...

MAL-2025-5120 Malicious code in netpackat (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f0f971eaa8aa4f59d981802034020fcd9b7c6008c2e9ed41a868a9e3186e7eed Code download and runs an executable, which is widely recognized as malware. The system is also configured to run it on startup, and the file is saved in paths...

Malicious code in discorddox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 52f656f62a0fe1e90282cf7e8004bfd78e69a854e5e7a9c33ef72b7e5b43b831 The package contains an embedded malicious executable probably blank grabber started when running the module. Probably continuation of 2025-05-pydoxing ---...

MAL-2025-4219 Malicious code in free-internet-dns (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 80f5bbcb50f9c9699a083711bb4d59905b49a198ddcd8c95425030d01d6a45e5 Installing the package installs a backdoor a qsocket.io and automatically uploads access credentials from the output of the qsocket client to the remote server...

Malicious code in solana-test-suite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 637014df713a194c727be0c3c8a6883b80fa29c7e66be089dd3bb82e49b915b4 Packages that seem to be created by a legit bug bounty hunter. Designed to look like created by different organisations, they contain a couple of data...

MAL-2025-4240 Malicious code in solana-test-suite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 637014df713a194c727be0c3c8a6883b80fa29c7e66be089dd3bb82e49b915b4 Packages that seem to be created by a legit bug bounty hunter. Designed to look like created by different organisations, they contain a couple of data...

MAL-2025-4220 Malicious code in glean-indexing-api-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c4f72985a496d7f564761c6862c160db30daaa442596d1cb609b0cc750bfad7a Packages that seem to be created by a legit bug bounty hunter. Designed to look like created by different organisations, they contain a couple of data...

Malicious code in badgerdoc-storage (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 57170ed58e2cf5e3b4b32f443ae555c7c040f2a395b3505837c90e06add93db5 Packages that seem to be created by a legit bug bounty hunter. Designed to look like created by different organisations, they contain a couple of data...

Malicious code in program-admin (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 79810d0cd56c8a3266dcbe5827dd3d27eb976b353c7b17940a29dddc602df4f7 Packages that seem to be created by a legit bug bounty hunter. Designed to look like created by different organisations, they contain a couple of data...

Malicious code in initer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d2aac1e40660cbe4323a93d03087f3b9a2d596a5dcfcf2bae3cb0a2ab37cf646 File is designed to download, hide under system-like name, and run a remote executable, widely identified as malicious. --- Category: MALICIOUS - The campaign...

MAL-2025-191834 Malicious code in pyinite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7ed8f43159750189f4cea17185b5ee087dda83db8574bf258010068c524fc723 File is designed to download, hide under system-like name, and run a remote executable, widely identified as malicious. --- Category: MALICIOUS - The campaign...

Malicious code in pyinitialyze (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 17fb73bd9014366b80018d085cf68a67535ca979bd2ddd14c82ef27ec1309a61 File is designed to download, hide under system-like name, and run a remote executable, widely identified as malicious. --- Category: MALICIOUS - The campaign...

Malicious code in matlab-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ff0a277d45885a5c1a26f027495e73b5e0aa8b49c7ee3eeafd06cc14e6e8f754 Importing the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-matlab-cl...

Malicious code in veriftest1asdla (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e04795c3a8f7fae13a125bde307aa64db04ae9f4ff76bd1d11fb32b4d3f57a36 During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-4250 Malicious code in veriftest1asdl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e11e583c94e6aea422cd70561ea53212b4b4a26dd4bcb2e42c4c1ad25066474d During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...