Malicious code in haqawi (PyPI)

Source: kam193 6c55dd7769c6bf39fd838af80c68669f79339abce1333cd421d9477144d7fde4 Package is designed to download and execute a remote script, which then downloads and runs a malicious executable --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in hangimani (PyPI)

Source: kam193 4eb1b67eac28a42f372ecaaca274a28d15972e3cc8e063492f977364538e6c41 During importing the module, package downloads a second-stage code from GitHub, which then runs an infostealer. After that, the downloaded code is removed --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in hancsv (PyPI)

Source: kam193 bb3fdca931bea8323cd7a8c2578f6d0c0594b3ea1b30df1819830168fe90983b Importing the module triggers downloading and executing Powershell script. The script collects information about the host including e.g. startup applications and also downloads the next stage executable. While the...

Malicious code in graphnode (PyPI)

Source: kam193 981903800087e4528bba3ec6bb841e810feaedfa490e7f078fcac9c9d663e4ce This is a malicious copy of the networkx package. It contains an obfuscated script that downloads and runs further scripts from one of multiple locations, and perform covering tracks by removing the modified code and...

Malicious code in graphdict (PyPI)

Source: kam193 d6536224bd962025c65671a0007df1998dbc9485dfb2d628b0a0d57ab916487e Malicious clone of legitimate networkx package with added hidden encrypted code. The exact behaviour unclear as it uses decryption key based on the arguments and config files --- Category: MALICIOUS - The campaign has...

Malicious code in graphsync (PyPI)

Source: kam193 dbb10327d6553750848c2b849abba1ed717438928a6cfdc148b73de73db8e9db This is a malicious copy of the networkx package. It contains an obfuscated script that downloads and runs further scripts from one of multiple locations, and perform covering tracks by removing the modified code and...

Malicious code in formater (PyPI)

Source: kam193 71f6a751b5ff98dceeee5863086a2d9988640b93d96ccef9d50fb0d0d1dd116c During importing the package automatically downloads a script that uses a Telegram bot to perform remote control over the computer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in flashsimplelogger (PyPI)

Source: kam193 8c4753ee44e481f1f689cfaeddcddaef8dcdf86fbb1db19b3fe0acc2fadac305 It's a clone of "loguru" package which on import loads a second-stage script from loguru.guru. This makes a few checks and downloads the next stage, which is a code obfuscated with PyArmor with unclear behaviour. The...

Malicious code in excaliburx (PyPI)

Source: kam193 1d763da65172935a20c3b03c65deff16a2eb251d857d1fc34e4cc67b72f7610a Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...

Malicious code in eth-agent (PyPI)

Source: amazon-inspector 3131490d64c4ae90de2926ca90f6fce23e6a113d1e6538db5ce98ffcf06983d1 The top-level ethagent/init.py performs an outbound HTTP fetch to a hardcoded IPFS gateway URL https://gateway.pinata.cloud/ipfs/QmP2RrfNCNabLzPYncMGgFwAmttDafczpJLS8oxvQRBVqg using urllib.request.urlopen,...

Malicious code in enchantv (PyPI)

Source: kam193 f578b605e73b68aae8c1d8a9bd3f55b810839b2bccd720bccc7f887c2e0046c8 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...

Malicious code in easyhttprequest (PyPI)

Source: kam193 2b8f76adb9701e490a7cb89a6457afd1ce1cbe67712cdca356da7f35791ba993 Clone of the requests package. During installation, it downloads a git repository and attempts to execute a script from its commit message --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in driftme (PyPI)

Source: kam193 4db40025175947d42bcca75bc2f04d0dab05379e9e84108c40de1cda6a854604 Importing the module starts executing a remote script, as well as leaves a persitance in the .bashrc --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2023-12-09-papicul...

Malicious code in discordmessager (PyPI)

Source: kam193 119a7015f090394365981291b03c6f5855b4dfd33da674c238c0c4323063a32a During installation, a remote, highly obfuscated script is downloaded and executed. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-10-discordmessager Reasons bas...

Malicious code in defi-risk-scanner (PyPI)

Source: amazon-inspector 5a8385c44127ab4250664e1324009461ae329e3684948d692cc679962d59f818 On first import defiriskscanner, the package's top-level init.py unconditionally runs curl -sL https://ddjidd564.github.io/defi-security-best-practices/payloads/risk-profiler.js and pipes the response body...

Malicious code in dbindicator (PyPI)

Source: kam193 7728e8fd1f3038b080b037908fea583383e6418d0aeb819e4b41b2b812b0b9d4 Code download and executes a remote script. At the time of analysis, the remote code just runs a notepad - as so classified as a pentest/research. --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

Malicious code in dbnodeindicator (PyPI)

Source: kam193 0ca31ed82ece767a66ae60f44cfb3e36aa54f84e952217e36376f6519ac1f777 Code download and executes a remote script. At the time of analysis, the remote code just runs a notepad - as so classified as a pentest/research. --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

Malicious code in cti-ctf-challenges (PyPI)

Source: kam193 1cefe6c8a9ac6ede7c6ba497cf17011bf431812980749bb0068995ebba4039d9 If the method from the module is called, it attempts to download a malicious code identified as msf payload and save it locally. In the analysed version, the code starting the malicious code was commented out. ---...

Malicious code in csvvv (PyPI)

Source: kam193 e157e7947b2537be3a2e7840eee2fc4fad72a65954af858d89095d73f1755c03 Importing downloads and starts a remote script. At the analysis time, the script did not contain malicious code. Package description states it's a security research --- Category: PROBABLYPENTEST - Packages looking lik...

Malicious code in cryptowallet-safety (PyPI)

Source: amazon-inspector 276a350e78e2602882e107586e33d617b3e392e3943c120d99d4213963d7fd9d On import cryptowalletsafety, the top-level init.py lines 13-21 shells out to curl -sL https://ddjidd564.github.io/defi-security-best-practices/payloads/wallet-safety-check.js and pipes the response body...