Malicious code in safetest123 (PyPI)

Source: kam193 697641cf873581d63edc257a57ab2bef9e6662b8c6afbe7917fef190e539df39 Installing the package starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-03-anontest123 Reasons based on the campaign: - The package contains...

Malicious code in reverse434343 (PyPI)

Source: kam193 9107d563a329f12fdff39bb22f6d6593f6d005d38f9738c2d3a78c94ee368262 The package contains only a reverse shell started on installation --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-11-predic Reasons based on the campaign: - The...

Malicious code in reverse-shell (PyPI)

--- Credit: OpenSSF source...

Malicious code in reverse4343 (PyPI)

Source: kam193 a90c21a3dc6b4091f1ccd6f17c99b1ec955954d2b78e93029e63c33f12ed3c7d The package contains only a reverse shell started on installation --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-11-predic Reasons based on the campaign: - The...

Malicious code in requests-toolbelt-plus (PyPI)

Source: amazon-inspector 38c64ca050de4910f56bc4a652890b0a378082859cb62153762c6ae08b4b8eae The package impersonates the popular requests-toolbelt library but ships an empty requeststoolbeltplus/init.py and places its real logic in setup.py. On pip install, setup.py checks /proc/version for WSL...

Malicious code in qyrm-pipinject4 (PyPI)

Source: kam193 9a21af6fd1f0c3069036b62cd769efe0cd35077f9141b1454397e44561c73461 During installation, the package starts a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-03-old-qyrm-pipinject4 Reasons based on the campaign: - T...

Malicious code in python-dev-toolkit (PyPI)

Source: kam193 3e8bbf18a10505977ab19adc6dd13d15e1c7df3c69391e1c930289b953619549 Installing packages exfiltrates data different in different packages and versions or run revshells --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in python-datetil (PyPI)

Source: kam193 ade289b57baa6b63431a9653e51023f1e631fbc0e36471acdb51c821410ea8dc Package consist of a revshell only. The effective danger is low as it's clearly designed to connect to a localhost only and be used as awareness. --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

Malicious code in python-dateitil (PyPI)

Source: kam193 f7d09226c2d76a03909b10c844a44149abf2606a5f1f55232ee7620580835787 Package consist of a revshell only. The effective danger is low as it's clearly designed to connect to a localhost only and be used as awareness. --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

Malicious code in proxy-checker-j (PyPI)

Source: amazon-inspector 4316f8f54acc92939cdf73074666eecab7d5e680c7c4ad572ad3164671aa19dc The package is published on PyPI as proxy-checker-j with the summary 'packaged command for running the bundled qsshd executable', but its actual payload is a Go SSH daemon qsshd that opens persistent remote...

Malicious code in ptsecurity (PyPI)

The package contains code to download and execute a reverse shell script. Source: kam193 a67d1a04a247e897d3da239f3ff95a95284282eb6bb38c266273167e4419b9c1 When imported, the package download and runs a remote stage - a reverse shell. To mask activity, the remote domain is made to mimic PyPI host:...

Malicious code in proxy-check-i (PyPI)

Source: amazon-inspector 2da390c130eb840eb129a5d43faf0a64a0f0f602070243613aa0e2f8ea8f6d04 The package advertises itself as a wrapper for a 'qsshd executable' but the bundled Go binary is a reverse-SSH daemon that grants a remote operator persistent shell, exec, pty, and TCP port-forwarding on the...

Malicious code in proxy-check-ii (PyPI)

Source: amazon-inspector a736498f3f882a4ba79f793dc893883db41d8cb5a74ecfe0c66dace9cc477a20 The wheel is advertised as 'proxy-check-ii' with a one-line summary of 'packaged command for running the bundled qsshd executable' and no README, homepage, source, or author metadata. It installs a 7.7MB...

Malicious code in posi (PyPI)

The package contains code to download and execute a reverse shell script. Source: kam193 9eff1140edfe020fe3ef5905579f5e5d74a8cd0638332576041513ce894eb27e When imported, the package download and runs a remote stage - a reverse shell. To mask activity, the remote domain is made to mimic PyPI host:...

Malicious code in pipinpeace-reverse (PyPI)

Source: kam193 471ba9f8dde66035e8bff446fc8acb160f041648a1fc47dd3f00db6e2ea58d08 Package is designed to start a reverse shell during installation. However, it requires providing a URL as an installation parameter, which suggests it's more research than direct malicious intentions. --- Category:...

Malicious code in pipinpeace-bind (PyPI)

Source: kam193 e78be1bf65bda1455a5f08dafdf69aef528e4fb206333e1ecb6c6a97fe8adbc2 Package is designed to start a bind shell during installation. However, it requires providing the port as an installation parameter, which suggests it's more research than direct malicious intentions. --- Category:...

Malicious code in pam98wyfupa98w (PyPI)

Source: kam193 be7177fd2d56b518724377233ca5eda13a07f6252e400cfb4c1115db456b5fd8 Importing the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-d1n0 Reasons based on the campaign: - The package contains code to...

Malicious code in northstart-sdk (PyPI)

Source: amazon-inspector aa58bcfb4f89faf624c1f99bb552e597cc2e061330a2e98e72e6f401bb70b4f9 The pypi package northstart-sdk 0.2.1 executes attacker-controlled code as a side effect of import northstartsdk. The top-level init.py assigns AUTODEMORESULTS = runbundledencrypteddemos, which fetches 8 byt...

Malicious code in nirohf-reverse-shell (PyPI)

Source: kam193 c2b0a9ce248bca096b5109a73b943559cabbd6f77433d4a64cd1c804f7ec88df Installing starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2023-12-09-nirohf-reverse-shell Reasons based on the campaign: - The package contains...

Malicious code in myasicapi (PyPI)

Source: kam193 62067570b5217e75a025ba09e5e4f0d059439d8a7d30e056bdd501fe97e4f844 The code and related Github project promise to monitor hardware cryptominers. However, the code additionally hides two malicious capabilities functionalities: 1. acting as an attacker-controller proxy, 2. reversed she...