Malicious code in huzzleup (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 96519e802e0761cc6f22ffc2dde7aee04fc6806f5831c1e98c15512792a3cd1d Package simulates malicious activity during installation and has no other purpose --- Category: PROBABLYPENTEST - Packages looking like typical pentest package...

MAL-2025-191762 Malicious code in huzzleup (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 96519e802e0761cc6f22ffc2dde7aee04fc6806f5831c1e98c15512792a3cd1d Package simulates malicious activity during installation and has no other purpose --- Category: PROBABLYPENTEST - Packages looking like typical pentest package...

MAL-2025-191627 Malicious code in ga3fario (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dbb5fde4b18804bfa8f4e885f395c7b94eac1d675efc79ea0d6628fabaefc3cf Packages that either reports home installation, simulate malicious activity or imitate Roblox API wrapper. --- Category: PROBABLYPENTEST - Packages looking lik...

MAL-2025-191626 Malicious code in ga3farifo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3bc2c3fabdc2922e9fa7c09fa14f8c09fe767171d3ea3518db70f119668651dd Packages that either reports home installation, simulate malicious activity or imitate Roblox API wrapper. --- Category: PROBABLYPENTEST - Packages looking lik...

Malicious code in rizco09 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6d76674451d8020f28e8d4421ba6ab31dc05411a8f252fd9ee14aaeed0fa758d Packages that either reports home installation, simulate malicious activity or imitate Roblox API wrapper. --- Category: PROBABLYPENTEST - Packages looking lik...

MAL-2025-191659 Malicious code in rizco09 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6d76674451d8020f28e8d4421ba6ab31dc05411a8f252fd9ee14aaeed0fa758d Packages that either reports home installation, simulate malicious activity or imitate Roblox API wrapper. --- Category: PROBABLYPENTEST - Packages looking lik...

MAL-2025-191653 Malicious code in ptxcompiler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a157c2b8ad78e45eea0b8e20ef6d466cdefbd686ac62041c13580048283ba7a1 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in ptxcompiler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a157c2b8ad78e45eea0b8e20ef6d466cdefbd686ac62041c13580048283ba7a1 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-191652 Malicious code in poc-suppentest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 34829d348b54453367c47f9936c2ea6953832cbf8396649c1d79813aabb93f4e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in egarcia-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f9528d01cc9eb845439565bd5b1446d74daa6a6ae76cd4acc3ffae124b2e0cb4 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-191646 Malicious code in makronlox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f918d3ae448737e8a58e16ad57af3037e27ba8ab02fef22ba6e0b4f6f2c49e1a Package automatically download and runs an executable, which then imitates a malicious action and requests ransom payment. --- Category: MALICIOUS - The campai...

Malicious code in makronlox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f918d3ae448737e8a58e16ad57af3037e27ba8ab02fef22ba6e0b4f6f2c49e1a Package automatically download and runs an executable, which then imitates a malicious action and requests ransom payment. --- Category: MALICIOUS - The campai...

MAL-2025-191650 Malicious code in musl-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 921a96dbb105de30a891a3770c85b1a240ad3625bb52b4e6276340c641b4a46f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in musl-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 921a96dbb105de30a891a3770c85b1a240ad3625bb52b4e6276340c641b4a46f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-191862 Malicious code in saintone (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d762a42d55901a472c7070197cef989428ecb0140acfe02c72d719d74b430436 Code downloads and starts an executable widely recognized as malware, then sends some results to a Telegram webhook. --- Category: MALICIOUS - The campaign has...

MAL-2025-191649 Malicious code in md5-en (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1c7608df27812e170abf1fa650287b87174700cd5a23658ae8d81317f7cd93dc Code downloads and starts an executable widely recognized as malware, then sends some results to a Telegram webhook. --- Category: MALICIOUS - The campaign has...

Malicious code in md5-en (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1c7608df27812e170abf1fa650287b87174700cd5a23658ae8d81317f7cd93dc Code downloads and starts an executable widely recognized as malware, then sends some results to a Telegram webhook. --- Category: MALICIOUS - The campaign has...

npm, PyPI, and RubyGems Packages Found Sending Developer Data to Discord Channels

Cybersecurity researchers have identified several malicious packages across npm, Python, and Ruby ecosystems that leverage Discord as a command-and-control C2 channel to transmit stolen data to actor-controlled webhooks. Webhooks on Discord are a way to post messages to channels in the platform...

MAL-2025-191629 Malicious code in hexdec (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b35c77c73cb594ed27985ac5e797ed54657a3301e976728e8fdf06dedb94e085 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2025-191648 Malicious code in mcp-runcommand-server2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 36fb61d44529c380f204d5a210017989695ef39df6adfce7ccfb08e48a17b594 Package starts a reverse shell to a hardcoded location --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...