Malicious code in supercolor-tui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9798fa32337256d29d4b551193b6aa6817601034ce787bae4d09d7d6636d813b Package hides a code downloading and installing an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...

Malicious code in skills-analyzer (PyPI)

Source: kam193 415c95c384a9901bda7b98bdcf86142c041e21de2759e7048769a49bf54d9bea In this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency is-it-ai, intentionally pinned by specific versions of...

Malicious code in multi-convert (PyPI)

Source: kam193 63d1834ac673303487e7c46affaf2be63ac0b142aaab8e79027144aad9cbd9de In this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency is-it-ai, intentionally pinned by specific versions of...

Malicious code in md-to-slides (PyPI)

Source: kam193 b11c84f48dc5185cf83056d55f0b2fa64fa415afae3f258baa5887c1ce44bc7c In this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency is-it-ai, intentionally pinned by specific versions of...

MAL-2026-18429 Malicious code in multi-convert (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 63d1834ac673303487e7c46affaf2be63ac0b142aaab8e79027144aad9cbd9de In this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency...

Malicious code in multi-convert (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 63d1834ac673303487e7c46affaf2be63ac0b142aaab8e79027144aad9cbd9de In this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency...

Malicious code in md-to-slides (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b11c84f48dc5185cf83056d55f0b2fa64fa415afae3f258baa5887c1ce44bc7c In this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency...

MAL-2026-18428 Malicious code in md-to-slides (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b11c84f48dc5185cf83056d55f0b2fa64fa415afae3f258baa5887c1ce44bc7c In this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency...

MAL-2026-18427 Malicious code in skills-analyzer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 415c95c384a9901bda7b98bdcf86142c041e21de2759e7048769a49bf54d9bea In this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency...

Malicious code in skills-analyzer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 415c95c384a9901bda7b98bdcf86142c041e21de2759e7048769a49bf54d9bea In this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency...

Malicious code in nebulallm (PyPI)

Source: kam193 50e0ed125f08fd7743ccfb40590c24304b4731f6a99b69bc553b5bb8b7e57fc6 During installation package first downloads a JScript script, which then downloads the next malicious DLL. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-18297 Malicious code in nebulallm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 50e0ed125f08fd7743ccfb40590c24304b4731f6a99b69bc553b5bb8b7e57fc6 During installation package first downloads a JScript script, which then downloads the next malicious DLL. --- Category: MALICIOUS - The campaign has clearly...

MAL-2026-18188 Malicious code in 1h1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 04938e0ebf8781fb6c986fda09db9f4a60c240eb6dc79ab33e6faf7a5589b353 During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in 1h1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 04938e0ebf8781fb6c986fda09db9f4a60c240eb6dc79ab33e6faf7a5589b353 During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in caracas4check (PyPI)

Source: kam193 fe298eb267ef99191242315438fe8b7a619bece89e39d3e607cc34af455c647a During installation, the code downloads a malicious executable from a remote location. The malicious action is triggered only on specific hosts. --- Category: MALICIOUS - The campaign has clearly malicious intent, lik...

MAL-2026-17198 Malicious code in caracas4check (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 973d711f03dafa9f390e489476d4795acdda8db926bdd688ca5e1abbe6efa025 The package installs boot.pth at the site-packages root, causing 'import c4cboot' to run on every Python interpreter startup on the host after...

Malicious code in pymem-win (PyPI)

Source: kam193 82eb1f11c9b56a2f2c3e97530db43ef94784a2c75697223828403927b0528477 During import, the obfuscated code downloads and executes an executable. The remote executable did not exist during analysis, but the repository used to host it overlaps with previous campaign 2026-07-yt-api-dlp ---...

Malicious code in pymem-win (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c611131ac135f4608698ce56eebd7dc89623b591510a050f2059369c9d51bbf Pymem-win is a near-verbatim copy of the legitimate upstream Pymem package reusing its description, repository URL github.com/srounet/Pymem, and auth...

Malicious code in uvhttp-custom (PyPI)

Source: kam193 9d56fe693f2b6e693e195640269a9ad95c8ab5eb94c897bbc711e897177c4cc6 During installation, obfuscated code downloads and executes an executable. It appears to be a game launcher. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in uvhttp-custom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc setup.py contains an obfuscated payload of the form lambda : execimport'base64'.b64decode'...'.decodeNone alongside an otherwise-benign setuptools...