Malicious code in evm-validator (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3438 Malicious code in blackspammerbd-vx1 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in aiolitesql (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1ef59c4a17296925677ec69703d25a3bd0541eb1c20eba25b0bc6918e908ddcf Clone of aiosqlite with hidden exfiltration of selected data during "executeall" query see L59-97 --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in aioasyncsqlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9dabf7e852a633394c9df21ee491c5a3582e2c172c624fd2b48cc127dbdc410a Clone of aiosqlite with hidden exfiltration of selected data during "executeall" query see L59-97 --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in reqinstall (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fabb4dfb4f519f848a714f96e09e2b5fbb289ffdd8cd86fc13c8fbf49b539962 Campaign is split into multiple packages that altogether exfiltrates data from desktop Telegram application. 1. "pyapiepo" is a cover package that provides som...

Malicious PyPI Package Targets MEXC Trading API to Steal Credentials and Redirect Orders

Cybersecurity researchers have disclosed a malicious package uploaded to the Python Package Index PyPI repository that's designed to reroute trading orders placed on the MEXC cryptocurrency exchange to a malicious server and steal tokens. The package, ccxt-mexc-futures, purports to be an extensio...

MAL-2025-3443 Malicious code in colorona (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 27014d3a14c4b1df61609aa62f901b3f8cb01f4898bb729d52d6cd08928555be If the method "SetTerminalColor", imitating colorama package, is called, then the code exfiltrated browser, discord and Minecraft passwords/tokens. --- Categor...

Malicious code in colorona (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 27014d3a14c4b1df61609aa62f901b3f8cb01f4898bb729d52d6cd08928555be If the method "SetTerminalColor", imitating colorama package, is called, then the code exfiltrated browser, discord and Minecraft passwords/tokens. --- Categor...

MAL-2025-3441 Malicious code in colorina (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5280fa2df728b98c1eda6d86d4b0fc233d4bd0d58ac17160427e16f1bb154081 Using the "color" function will exfiltrated data like discord tokens, browser-saved passwords and Minecraft access tokens --- Category: MALICIOUS - The campaig...

Malicious code in colorina (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5280fa2df728b98c1eda6d86d4b0fc233d4bd0d58ac17160427e16f1bb154081 Using the "color" function will exfiltrated data like discord tokens, browser-saved passwords and Minecraft access tokens --- Category: MALICIOUS - The campaig...

MAL-2025-191915 Malicious code in ultrafasttelethon (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 73a960b0cd2d21f8bde61f22f956a4c2a02ccddd9e1277eef23d3d8e0406cba4 Clone of Telethon package that exfiltrates credentials. See client/telegrambaseclient.py L608-626 exfiltration function and client/auth.py L163 usage. ---...

Malicious code in colorinsa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ea605189c0cea53175b8c70e9163dcc15333629a93b9ea991d154486c931950c Using the color function triggers attempts to exfiltrate browsers data --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-3442 Malicious code in colorinsa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ea605189c0cea53175b8c70e9163dcc15333629a93b9ea991d154486c931950c Using the color function triggers attempts to exfiltrate browsers data --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in runningwifi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7c510d8dbbc3448272c337960c786b9b9731fe97773a4bfd48844527c7e6bed6 Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in randomwifi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 69dd88ab3dd3a84c89517f453703ddfd713ccc663b6641d5cf098e17bcdfe500 Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in sccket (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a4f6b8eead6d682b7462da07822a284425fa81c17b9493dd8702ba6a8e5fbb7 Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-3463 Malicious code in randomwifi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 69dd88ab3dd3a84c89517f453703ddfd713ccc663b6641d5cf098e17bcdfe500 Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-3468 Malicious code in runwifi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 83046dbbe0f24ed7ffb9087d78c161e332436c45f2f3f4433606ebb9fd9cc52d Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-3469 Malicious code in sccket (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a4f6b8eead6d682b7462da07822a284425fa81c17b9493dd8702ba6a8e5fbb7 Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-3437 Malicious code in bitcoinlibdbfix (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a5cb52fa4f2ac6a68416c59a513399e01bb388d5e238260b712a513db3d97233 It overwrites the 'clw' command from legit bitconinlib package and attempts to exfiltrate its database on the usage. As a context, it appears to be created to...