Malicious code in newpackagetest2024 (PyPI)

Source: kam193 1e2e6f858089751c96fa15bde74d24a4dc6a68758e3ee4870a9c0d1f7c66d378 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...

Malicious code in newpackagetest2027 (PyPI)

Source: kam193 7c1e4acddbaeafd87b1cce82ddc1025a3e5abd4c285a2fd2e7fcff07d37d500e Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...

Malicious code in newpackagetest2028 (PyPI)

Source: kam193 3f8a309179fb8daa3b3ff1d8a250fe566f5d138ab913e435928491185de07f1c Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...

Malicious code in newpackagetest2026 (PyPI)

Source: kam193 7b2facdf5925f09b064136d0c919a80e0e83d0a13b4b6f9d903162352c586dc9 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...

Malicious code in newpackagetest2025 (PyPI)

Source: kam193 bb87fd7186acc9af957e5155c0bfda87798fa733efdea43ff60f647c3eb439a0 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...

Malicious code in nanoinstaller (PyPI)

Source: kam193 9f6ea4dd9867e528445ba01d2ceed3638e6178b2a940a2598c0f89eca5795802 Package is designed to download and execute a remote script, which then downloads and runs a malicious executable --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in metemask-sdk (PyPI)

Source: amazon-inspector a99855c93b46f7b996a005065c319bbb24c9d1f497d05dfd38fc83d1b21facdd metemask-sdk is a typosquat of the legitimate metamask-sdk package. On import, the top-level init.py performs an outbound HTTP fetch to...

Malicious code in managment (PyPI)

Source: kam193 754c9b609bb8dafc0fd21d141cd216744d9f2aa1f23898990c52e872fdc23e1a Installing the package starts a revshell and download and starts a remote script depending on version, different malicious functionality. The name seems to imitate CPAN.org --- Category: MALICIOUS - The campaign has...

Malicious code in marshel (PyPI)

Source: kam193 d1b25f97e5a657b33bb26f2ccdfbdb55e459274a4cb3e19e38d3f04ba6ea3583 The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category: MALICIOUS - The campaign has clearly malicious intent, li...

Malicious code in loquru (PyPI)

Source: kam193 a98209ec0f506986521ebd7b24de4f266f6bb61aba50f2dc511c391f1037848b It's a clone of "loguru" package which on import loads a second-stage script from loguru.guru. This makes a few checks and downloads the next stage, which is a code obfuscated with PyArmor with unclear behaviour. The...

Malicious code in loggerex (PyPI)

Source: kam193 7a27ca3e673f54a1e041d55e84b8a0e871239df2331c9a3fd1dbe20d1fa86f56 It's a clone of "loguru" package which on import loads a second-stage script from loguru.guru. This makes a few checks and downloads the next stage, which is a code obfuscated with PyArmor with unclear behaviour. The...

Malicious code in lnatainstaller (PyPI)

Source: kam193 a613dbd371593bf6bcb7ae528a4d7d7dba2fedfc6670c8cb493bb5cbee18f734 Package is designed to download and execute a remote script, which then downloads and runs a malicious executable --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in lightmock (PyPI)

Source: kam193 a3c7924362f935b55a808e1ede8ffea2dbc96326b853dc00d7ede36c002ff63c Clone of a legitimate package. During import, heavily obfuscate code downloads next stages and finally exfiltrates sensitive data, including data from web browsers. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in legendevil1 (PyPI)

Source: kam193 3188a850ecb974606264f28634afaca67ec2f49c1c759cf590aa39ba19e50452 Package is designed to download and execute a remote script, which then downloads and runs a malicious executable --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in kraken-trader (PyPI)

Source: kam193 4bf5ec6e8a6020de1e122cf07f2dde0f02fa1a484ff984586db379729da75523 The package is a loader of malicious code disguised as remote "credits" code. The remote location, built from the parts in the code, delivers highly obfuscated JavaScript code that could be executed by the node.js...

Malicious code in kcvlib (PyPI)

Source: kam193 4a441a8e0abdd54964ca9e0a5e3a1d0e0c0435f05d80ab9e9210e10194a16f3d During import, the package downloads and executes obfuscated code. It appears to be an infostealer framework --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in justanything (PyPI)

Source: kam193 206471fdab67d7afeeb5fa6ee55cdb14b88338b58b50a5b73f31bbbb5e66e65b Code is designed to download and run remote scripts during installation, which finally downloads and starts an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in just4testlm (PyPI)

Source: kam193 5aed012f2ecc4af261bb7f2fc294b9aee5c0733ccf207b9e9e9a381d51387811 The package likely tests different malicious techniques and delivering payload in setup.py. Different versions, like 0.1.0, 0.4.0 or 0.9.0 contain malicious payload in setup.py that either run remote script or...

Malicious code in jsonschemex (PyPI)

Source: kam193 21f678f82847db32c68ab5a95a827f755d13b5d4cd371667eb584f25ed28ed01 Malicious clone of a legitimate package with hidden code that downloads the next stage scripts. Analysed payloads had just exfiltrated basic infos --- Category: MALICIOUS - The campaign has clearly malicious intent,...

Malicious code in jsonschema-viewer (PyPI)

Source: amazon-inspector 3692022b4caf5ac51d868aaae58e793520ac3bd36703841eb615942baf85bb87 The package's only function — main in src/jsonschemaviewer/main.py, registered as the jsonschema-viewer console script — invokes os.system to fetch a shell script from http://49.232.169.67:8084/slt via curl ...