MAL-2025-6608 Malicious code in tronlibapi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9691194771bc292f5583fcde670bceb7173ec8ec2e1f4a16f1af1322fce21a80 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in tronlibpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3830f2a3daeaf5ef1da928f6700860805f4fb3b0f955ab814f4742b334ca7868 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in trongridlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 810f3d44ffd0654acef07cf5bc57e4c1c8daa207332751a60c14f29f64832560 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2025-4249 Malicious code in trxtwo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 09ce47da0f3bcc2487cbee6b36384d2712ca257abba3155fcd0f13d9f7acd581 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in web3automation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 09a3fb2947bb8eaaf1e65033e8ccee659633669d5de0c0456b4c2e1680317dfb Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

MAL-2025-4271 Malicious code in web3wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e85209b2472e1db082515ccc7ca0b38a2e268379adc9547ac41af812aebc6fd7 Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in ora3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9d9ff95457d63990b263b77b0f3468dcd63e0d1837c81843b2d4249706db48c7 Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in websign (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 25ea98e45fc0e99bfc731d77e2205bd14c901fc33ba6b8639b441b97739db0e2 Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in web3author (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d5eac126109d648cac7a74217f0bc4b9e9bd0d07dc400924bf346f90b4b7ad9d Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in walletrpcs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4b93b9b49f17c924bbca7ba78750257a7be53f8d48ad200a16dc5eb4e369a734 Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

MAL-2025-4273 Malicious code in websign (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 25ea98e45fc0e99bfc731d77e2205bd14c901fc33ba6b8639b441b97739db0e2 Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in web3evm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6c2f7724a72031eda7b5c33755802a67784979e2a9459d83698b0637be68630b Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in web3yrpcs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 171ec4f4bbfb34688348ecdda292249487574c8fb28caf8467c0bbafb1563cb7 Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in web3wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e85209b2472e1db082515ccc7ca0b38a2e268379adc9547ac41af812aebc6fd7 Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in walletweb3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 03c7d45b1b392aae3891836f4e5083004be7ac61c0001ee649b834fefceb638d Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

MAL-2025-4260 Malicious code in walletweb3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 03c7d45b1b392aae3891836f4e5083004be7ac61c0001ee649b834fefceb638d Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in pretty-cli-logger (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 94cd11911ce2a0937d9e56087ce9487db18da5bb20df7f1f8948f8356d65c31d Contains an obfuscated code that will download and run a remote script. At the time of the analysis, the remote URLs were delivering empty results --- Category...

MAL-2025-191801 Malicious code in neov (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0c9e3f275318dc63c36dbc902dfd73c0b3aa4fa830d114c0833ed8d24258d9b0 Importing the module starts exfiltration of ".session" files, which appear to be used at least by one Telegram library...

MAL-2025-191849 Malicious code in qtpv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2e0cfa610f53699fb3d04d6296bf28540a6162be41a7268566e999b070b517a6 Importing the module starts exfiltration of ".session" files, which appear to be used at least by one Telegram library...

Malicious code in ark-vmp-reverse (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 28ac22df743a6a65eed4d1d25f66c0f3eb42c5235dc749a84162883d313bd415 During installation, a website with the current working dir is being called. It looks like something between spam and pentest as the website is most probably n...