MAL-2024-11621 Malicious code in kersa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d622fba4f0f9e74871fb87964bdc3818e244e0f9669a814ae71b923ff699e9be During installation, a cryptominer is secretly installed and started. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in torhc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 385cb451ed567a10096fce231790d6a9bce59bb47c8d7bdfff5a8f4aaa0854ed During installation, a cryptominer is secretly installed and started. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in kersa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d622fba4f0f9e74871fb87964bdc3818e244e0f9669a814ae71b923ff699e9be During installation, a cryptominer is secretly installed and started. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in pdf2doc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ae55659200290f97e3d07c41d49af574eb14ad3dc5913535e8d100cf2c48dd58 During installation, the code attempts to exfiltrate basic data username, host name and send to the attacker. The package looks to be a clone of an existing on...

MAL-2024-11653 Malicious code in package-lib8127 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2e0e446a5a40a8c6a1ea1041fa0fc875ef0dab2a8ad10cc74e459221906e6851 Package contains CStealer, a known infostealer, starting on importing the module. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in package-lib8127 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2e0e446a5a40a8c6a1ea1041fa0fc875ef0dab2a8ad10cc74e459221906e6851 Package contains CStealer, a known infostealer, starting on importing the module. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2024-11704 Malicious code in sendtowev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bee6e22271136b92077edad317e9a1e3eaa120bba73814159142d522cba12ced Package contains CStealer, a known infostealer, starting on importing the module. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Google Fixes GCP Composer Flaw That Could've Led to Remote Code Execution

A now-patched critical security flaw impacting Google Cloud Platform GCP Composer could have been exploited to achieve remote code execution on cloud servers by means of a supply chain attack technique called dependency confusion. The vulnerability has been codenamed CloudImposer by Tenable...

Malicious code in request-wizard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ff748393cb55e78c43fea879bbd55034152148246aa8d45359cfa8517845e17c Importing the module starts an Infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-09-hyperreq...

Malicious code in hyperreq (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a4662a05cce5bc61521e977b78c1abdb16ecaed027888309aa86ebf22166222b Importing the module starts an Infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-09-hyperreq...

MAL-2025-3464 Malicious code in request-wizard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ff748393cb55e78c43fea879bbd55034152148246aa8d45359cfa8517845e17c Importing the module starts an Infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-09-hyperreq...

Malicious code in colorbytes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 aa4677648d784f5460e80091c656719fc082e6ed9028940b407c97b0e78ff008 Extremely obfuscated code starts when importing the module, and then downloads the next stages and configuration from pastebin. They include a whole range of...

Malicious code in coffin-codes-net (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 df624a59b2cb5ef5cf295a7e63718bf7938250f59c5cda19bb6f43c40824e99b So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by...

Malicious code in coffin-codes-2022 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6c58561bbec76769fed6ea31b26a57f72ff7242de59c7c6f297a14b56f9b547e So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by...

Malicious code in dirutils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c67eead763edc5b56dadc5bfcec545f8799586732b861a6e661050d1165bc7e8 Package contains a compiled infostealer that is started instead of promised functionality --- Category: MALICIOUS - The campaign has clearly malicious intent,...

Malicious code in gmacpyutil (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7522b589abf570f1591bcd3eb29e4a900791d28901d30c5b57f151e899f94839 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in pwnstar-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0b5a94b7cc47cb91bf552abe43f1a0d078ed5c6e668c5ff4caa8c4d9f6d14177 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in ateslassia (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7b3ae00037330440de3fd0b333720f254e1549b277a12df5d31fb7f70d771daa Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in test-packages1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5c5608702af52a2ca19f0b384036f76248848f4b4ddbe582631d85b3f5e77dca Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

MAL-2025-929 Malicious code in gmacpyutil (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7522b589abf570f1591bcd3eb29e4a900791d28901d30c5b57f151e899f94839 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...