Malicious code in syschecker (PyPI)

Source: kam193 81ab746bf511a8c6c41c5776e5688c310a5255c65fda0fad65e31b1ed534dc91 Package downloads and runs an obfuscated bat file, which executes malicious activity according to VirusTotal results. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in set7 (PyPI)

Source: kam193 8e2e9040a08a54eb2600701e50e4137fd9959873e23cb5c6c4845e0a4f3f6564 Package downloads and suggest opening an obfuscated script, which is an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-set7 Reasons based on the...

Malicious code in roboat-util (PyPI)

Source: kam193 869ea4b94181bc5ef23562a4d749b462fb7079112cca74072ee9036fb397921f During installation, a malicious executable is downloaded and run. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-03-rowrap Reasons based on the campaign: -...

Malicious code in roboat (PyPI)

Source: kam193 f04db4869c9e981873683b537f335c1f25c7c17c283315859699855a9c20816b During installation, the code attempts to download and start malware. Connected with the campaign based on the time correlation and other packages published by the author. --- Category: MALICIOUS - The campaign has...

MAL-2026-2122 Malicious code in rowrapee (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 398cfbdac2d3602a5c9836408942993c3f2bbcda911184825f01cf9937fb035e The package hides code to download and start malicious script containing malware, identified as adware. The triggering method seems to be PTH file, although it...