Malicious code in richcolor (PyPI)

Source: kam193 50d5904bd379a75fd43115d7339df3d79f87ec691026774160b15b8632a9f8ae Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...

Malicious code in requeses (PyPI)

Source: kam193 60e475750b95349319dcce7f69afe6399fe78c271b772c001f7a01df5e1e7bba Typosquatting package with a Telegram-bot with RAT-like functionality. The code has been changed a bit compared to the previous incarnations, but keeps the same capabilities. --- Category: MALICIOUS - The campaign has...

Malicious code in regixtest (PyPI)

Source: kam193 5bd4402c3382436a949c662f36088697ac7a3a0fd22e2c91fdf2102231e2392c Obfuscated code contains e.g. capabilities for downloading and executing code from a hardcoded location. It's also recognized as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in rarcore (PyPI)

Source: kam193 69082900a353e728be770b24c10b27f0f2b7cb9f5ec15179833976447fc6c424 During import, this malicious copy of a legitimate package downloads an encrypted data disguise as an image. It contains an archive with a next-stage script that uses the Polygon blockchain contract...

Malicious code in qdatainstaller (PyPI)

Source: kam193 e4ee574ced05e27b63477cb84af816e02ae259c67246f4f31ff63819e7e1048e Package is designed to download and execute a remote script, which then downloads and runs a malicious executable --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in pythonhttp (PyPI)

Source: kam193 3ed5759c2260c5467724f053f3d59eac62f5491fc2d03350fef0a6f832652e3b Installing the package starts a heavily obfuscated Powershell Script that attempts to at least overwrite copied crypto wallets --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in python-rootpath (PyPI)

Source: kam193 bb867560d676e7b79ce110b230906a9630feb223cbcb6072bff5a2636c60a3c7 Hidden code downloads, saves and import a remote script. The package itself is a clone of a legitimate "rootpath". At the time of analysis, the remote script did not do any harmful action --- Category: MALICIOUS - The...

Malicious code in python-bitget-request (PyPI)

Source: kam193 bf787bcce66ad47046d93086a114a0f144b0f538b3d969fea6aea42b2312f58b Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by...

Malicious code in python-bitget-wrapper (PyPI)

Source: kam193 769187e87797e69e9ebfc00eb97274a91fea1c86b1472b4ef6436441f737c8b9 Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by...

Malicious code in python-bitget-connect (PyPI)

Source: kam193 1797b7fdf9859888b5495817784ead0bdc01e6acad5ae410af1e1df89acbded6 Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by...

Malicious code in python-bitget-api (PyPI)

Source: kam193 cac6988c3746b27c0cc34a156657431c2a0c0c36de45c6b88a00130d30dfd66e Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by...

Malicious code in pyrogrem (PyPI)

Source: kam193 42a10da9545ede038913b53b3619d36a94708a854536263f6a97c5d4d30a9b65 The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category: MALICIOUS - The campaign has clearly malicious intent, li...

Malicious code in pyrogrqm (PyPI)

Source: kam193 02c3334952bcf80c0523b20a24f0b744463a944a4f3d18dc45a3f3c1bd00c1eb The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category: MALICIOUS - The campaign has clearly malicious intent, li...

Malicious code in pydefender (PyPI)

Source: kam193 a1e2cc2d94eff74e302118c35c34f87e76175fe507facbe21c29883960c8223e setup.py is prepared to download and run an obfuscated batch script. While the script is not detected by any AV currently, in the sandbox analysis it reveals behaviour like adding exclusions to Windows Defender ---...

Malicious code in pyfiglets (PyPI)

Source: kam193 66caa962e9fedf67dff7c9da840c4a4dcdca71f237d2e36f332f5b5bd32750bc Malicious clone of pyfiglet. Importing the package starts a series of downloading and executing of obfuscated malicious scripts, partially identified by AVs. --- Category: MALICIOUS - The campaign has clearly maliciou...

Malicious code in pretty-cli-logger (PyPI)

Source: kam193 94cd11911ce2a0937d9e56087ce9487db18da5bb20df7f1f8948f8356d65c31d Contains an obfuscated code that will download and run a remote script. At the time of the analysis, the remote URLs were delivering empty results --- Category: MALICIOUS - The campaign has clearly malicious intent,...

Malicious code in pipmodule823 (PyPI)

Source: kam193 57b078ffca6f219848df2289282933442be06a2932d0d163ede59fe4a533faca If run as a module, the package downloads and executes a remote script. At the time of check, the remote script was just opening a popup; thus it's not classified as clearly malicious. Through the package description...

Malicious code in pipmodule83 (PyPI)

Source: kam193 95b01ea01a7fd1ff5e52491e6b143aa98f45a6f331814222fe38e76ad3ac0863 If run as a module, the package downloads and executes a remote script. At the time of check, the remote script was just opening a popup; thus it's not classified as clearly malicious. Through the package description...

Malicious code in piedefender (PyPI)

Source: kam193 f8a30e991bd97073c50a9cdabb10842f2c5ae074c46fcd0aeff5d7917d4b56fa setup.py is prepared to download and run an obfuscated batch script. While the script is not detected by any AV currently, in the sandbox analysis it reveals behaviour like adding exclusions to Windows Defender ---...

Malicious code in pdatainstaller (PyPI)

Source: kam193 671a0098c14338197a26cb64b7f5c35c0e741f3151313fff784bc7a4862ad579 Package is designed to download and execute a remote script, but the script itself seems to be broken missing or wrong URLs. It's most probably a test before next packages with real malicious content. --- Category:...