Malicious code in cfgzen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 588fed6ec45af5cfb8925b1f7d93b07b73d47b919a50305438153dfbb7f953e1 The malicious code sits in a native module, which is called in a few places, including the code run via PTH embedded since version 1.0.6. The native module...

Malicious code in govapkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...

Malicious code in comp-colors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1aad1b8a73afbe28c708c4e19a1495793d1214980f72357a13d07b98f1f9a060 The package hides code to download and execute a remote executable from a newly created fastsyncapi.com domain. It is disguised as a remote 'fast color helper,...

MAL-2026-10780 Malicious code in data-parser-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 55aca4874dc8f9716a1fb1dc61088cf485bee1b7a1ec8a5dc8c19aabff2c71fd If using the provided functionality like parsejson or parsexml functions, the package will install a Mythic/Poseidon C2 framework beacon and ensure its...

MAL-2026-10917 Malicious code in tinkoff-cloud-apis-internal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 30caca1d5e67322644a0eb6cf8098151d975415baab826d14a0bba75117ae95e Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is...

MAL-2026-10916 Malicious code in python-devplatform-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2b75d4d8e3c822aa82b716e6752c0901447845d442973ce9bc35c78b9c81c78a Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is...

Malicious code in govpkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcc7609ef2380436c805298b1d10362d361ea93b448db92433e3e69cc2de8ed8 Every public API function in govpkg get, package, module invokes a helper named normalizeHelper that downloads an unpinned, unverified binary from th...

Malicious code in discordia-telemetria (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7b7d95c58f4a5203f542a11bc6e8ea0ff4d55bf22b2db938b563f169a732265 setup.py contains a base64-encoded shell command that decodes to a curl fetch of an opaque binary from https://gaming-telemetry.com/v1/download, chmo...

MAL-2026-10702 Malicious code in discordia-telemetria (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7b7d95c58f4a5203f542a11bc6e8ea0ff4d55bf22b2db938b563f169a732265 setup.py contains a base64-encoded shell command that decodes to a curl fetch of an opaque binary from https://gaming-telemetry.com/v1/download, chmo...

MAL-2026-10701 Malicious code in discord-telemetry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b8a926675ed9f43b0067def4bd625208d08a08c8750fd3c2f9f7bfd6138e3d4d During installation, the package downloads and executes a remote executable. Before 0.1.5, the code contained local-only tests of malicious behaviour. ---...

Malicious code in pylogora (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfecc686b83d148b0b68acd99fe38f484c035c5b9c59fb7623378866e8e307cc pylogora/init.py invokes a at module top level, so any import pylogora triggers the payload. a base64-decodes hidden URLs and filesystem paths,...

Malicious code in log-guru (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6da98c6d79df38328235bb1df969316bd484b2a02594f8656772cd9a1e48f16b The typosquatted package installs a Mythic/Poseidon C2 framework beacon and ensures persistence. After installation, the beacon communicates with C2 on...

MAL-2026-10091 Malicious code in qlinforge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 713a696ce725031aab16903d7a29c80611a4c4368c7e35bacf29069a3581c602 setup.py registers a custom install command that, on Linux, downloads an opaque binary from http://115.190.124.243:9090/payloadlinuxamd64 to...

Malicious code in playwrightr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e165b925f82629524e611c81597c32a171df7cec246dc73f268d8192ccbe2c5 setup.py registers a CustomInstallCommand that runs automatically on pip install under Windows. It uses WinHTTP via ctypes to fetch a binary from...

MAL-2026-10020 Malicious code in playwrightr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e165b925f82629524e611c81597c32a171df7cec246dc73f268d8192ccbe2c5 setup.py registers a CustomInstallCommand that runs automatically on pip install under Windows. It uses WinHTTP via ctypes to fetch a binary from...

Malicious code in pyqt6darktheme (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8cd6d16792d681b160ae1e11b3f698d8fd3004cd6019704008ad1c649fbe6f67 Package downloads and runs a remote executable, which was found to downloads further exes and starting coine mining --- Category: MALICIOUS - The campaign has...

MAL-2026-6758 Malicious code in httpprobe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb46b890b54f51f3a98c1935dbd50e143430757c5daf4080039d32865b04c1d5 The package advertises itself as an 'HTTP probing tool for security researchers' but contains no HTTP-probing functionality. Its only behavior is to...

Malicious code in httpprobe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb46b890b54f51f3a98c1935dbd50e143430757c5daf4080039d32865b04c1d5 The package advertises itself as an 'HTTP probing tool for security researchers' but contains no HTTP-probing functionality. Its only behavior is to...

Malicious code in bytekit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bbaea22b635a4a8425964572b733b806f45714a9090492d1c39d545088fe336 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

MAL-2026-6751 Malicious code in bytekit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bbaea22b635a4a8425964572b733b806f45714a9090492d1c39d545088fe336 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...