Malicious code in cv-train (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e63e889d2bfc807902ef5bcd86b6d65b95272587726dda61e4efb63d461fc3b setup.py defines a phonehome function invoked at module top level, so it runs during pip install. The function collects the machine hostname, usernam...

Malicious code in dac-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 203490886d6928aee2c8d681d282f53d8513907b30be5e5e20fe1effb5fd21d2 On import of dactools, the top-level init.py executes whoami and hostname via subprocess, concatenates the results into a DNS label, and triggers...

MAL-2026-15931 Malicious code in metricboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a511a75c8c42dcd677dd3814265d3befefa7f339bdc6b0336788635813e837 MetricBoxLite 1.0 collects the installer's username getpass.getuser and hostname socket.gethostname, JSON-encodes them, and POSTs the payload to a...

Malicious code in metricboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a511a75c8c42dcd677dd3814265d3befefa7f339bdc6b0336788635813e837 MetricBoxLite 1.0 collects the installer's username getpass.getuser and hostname socket.gethostname, JSON-encodes them, and POSTs the payload to a...

Malicious code in flask-header-guard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5e0cbaefa0fcface340b03a236573ed70df9b4d7773715321df057a9862e3f8 The package is presented as Flask security-headers middleware but ships a hostile payload wired to fire at install time and again whenever the librar...

MAL-2026-14401 Malicious code in multyproccess (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7938a109a642dfe8b161e9568d6373a038c3413c0fd1f2b01702f4f173348553 The package's setup.py overrides the install and develop cmdclass to base64-decode a bundled request/.payload file and launch it via...

Malicious code in morpho-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cb58dff63faa08e128ddd0d8d38b82c0711bb60d09d19755a8e8f398fa7d511d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in pydanticc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bc3a091548db52bab3bf8556e95780b3041aa971b6353d7f31bdb71128915a1 pydanticc is a typosquat of the popular 'pydantic' package. Its setup.py defines a custom setuptools install command whose body is stored as a base64...

MAL-2026-6734 Malicious code in horde-python-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2ae9afcd7af22c82b137c1142ae643502d82f3d1f28712b2e5c7ec412bea85e horde-python-client 99999.0.0 is a dependency-confusion lure. On import hordepythonclient, a daemon thread unconditionally POSTs a JSON payload...

Malicious code in my-test-package-2025-xyz (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a2f3ab0a3c7ef9009c99575d9dd051c4a97575435cabf5d3a4c223f53bc47b89 During installation, the package opens a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in mistral-evals (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f79806b5d197ed3b6beeedfb7092ad6da36d1d186ad57dc12be0b030c63726c9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in alembic-util (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8e9b764ee0ccd6a2c6c2db1b7722f083ee9f643cb99d03821d5e6571f68db253 During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating...

Malicious code in apexomni-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 497dca02206d8084e5a7e135245489a5ef9dd03f318b138574bc43386ddac0ef During installation, multiple sensitive environment variables are being exfiltrated. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-3192 Malicious code in ro-db (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2bd23f786275f7f9939deab001c8b06daaba21ad7dcb861fd6bb9cdd2e3d830c During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

MAL-2026-3087 Malicious code in bytedark (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b1b29d53129e34fa2f09eacd9218f1bf87711e4a88587ee9c5f4453cfb6974ac Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-3091 Malicious code in bytedfaas (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ec7e2decd402442fba2d4ebd7637b596a33ef132120ffe4f3a8b5d2d6ce8475e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in bytedpgsql (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 645f636a2360d86d320bbf691de6457d8df8a7e066fa3fce10b8a85f8576a7a2 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-2965 Malicious code in build-metadata-logger (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 be01b550f3d8914aa6bd8659c9a410054e4e0bf9203d33e93478eb444e957b55 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-2557 Malicious code in databasesupasafe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 462606bd9f9e3129dcfdd3d667ea6d87e8f58f32ee61727dc133ecb9465d9e37 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

MAL-2026-2544 Malicious code in roboat-utilities (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 615237831a485ffde23ee69088df25f4ef45d00e99aab6fff27b7ee28f781890 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...