Malicious code in improvado-layout-panel-metrics (PyPI)

Source: amazon-inspector 61cc6b0b5d5efe4675f4159e8bc8f6380970614c1dc36b553207fa73fa66104e The package's top-level fluentpanelmetrics/init.py defines bootstrapruntimeprofile and unconditionally invokes it at import. The function opens a TCP socket to 34.69.137.236 on port 80 falling back to 443,...

Malicious code in hkmat (PyPI)

Source: kam193 c3c3063747c35c5ae091331ac2c35dbef66c945aca73b06ee32ef1f0ec088009 Importing the module starts a telegram bot that connects to a chat and executes provided commands --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-talbat Reason...

Malicious code in hellohackers (PyPI)

Source: kam193 63788f1f3223270be7955b619eb09fa7e7f401084e4332ed732d33b522782a37 File contains a metapreter beacon that runs in the setup.py. Analysed version uses a local IP as the target. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in hekamhelp (PyPI)

Source: kam193 ac329f6244d2faf82ef12a167d1b46de2a9043fb1c086b67a45458d75d227562 Importing the module starts a telegram bot that connects to a chat and executes provided commands --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-talbat Reason...

Malicious code in hello-test-s1 (PyPI)

Source: amazon-inspector e168a49ebd07050fbf35d1cd9714b289903c0593b9bdef27874f975be60461b7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193 3e38aef2a7eaa434284aa00122cf429e1a1a07658e02afec7bb3690d7cbfe9ec During installation or...

Malicious code in genz-translator (PyPI)

Source: kam193 983b5b328e433d81113b3e170f313aba83ae5eff0ecd515fc9865ca3a5be1ee9 Installing the package installs a reverse shell. As the mentioned domain doesn't seem to exist, it may be a test designed for an internal usage --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in gemini-analyzer (PyPI)

Source: kam193 1c8996b17229185440fe7523f20f72ea848f3a001baa8946ca80fa6b5d3221ad The package is a RAT performing full exfiltration and executing remote commands through a custom RPC protocol over WebSockets, and eventually establishing a reverse shell. --- Category: MALICIOUS - The campaign has...

Malicious code in free-internet-dns (PyPI)

Source: kam193 80f5bbcb50f9c9699a083711bb4d59905b49a198ddcd8c95425030d01d6a45e5 Installing the package installs a backdoor a qsocket.io and automatically uploads access credentials from the output of the qsocket client to the remote server. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in fluent-panel-metrics (PyPI)

Source: amazon-inspector 95598f66d3e0a4ecbfe9dcd01c1d5f0be9b78bee23b200758a92dac8f8a00d9e fluentpanelmetrics/init.py defines bootstrapruntimeprofile and invokes it unconditionally at module load. The function opens a TCP socket to the hardcoded IP 34.69.137.236 on port 443 with fallback to port 8...

Malicious code in fluent-dashboard-panel-metrics (PyPI)

Source: amazon-inspector 9e745c609fb43daaa93911ae2edcb05b1ffd3cec1c6ec55c321597e9e39eb153 fluentpanelmetrics/init.py defines an undocumented function bootstrapruntimeprofile and invokes it unconditionally at module top level. The function opens a TCP socket to 34.69.137.236 on port 80/443,...

Malicious code in flask-auth-sys (PyPI)

Source: kam193 a241889bfae20aee5395660063d13f337aa9733c14b02bf2edb004d6d36e1d41 On importing the module, the code attempts to span a reverse shell. In the current version, the remote domain does not exist --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in flask-auth-system (PyPI)

Source: kam193 debc87eb7af33e5146831c7e1b8ff69ccdebe2c9bbf353216c719b10ebe8431c On importing the module, the code attempts to span a reverse shell. In the current version, the remote domain does not exist --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in evil-py-argo-shell (PyPI)

Source: kam193 1739dfc040a7678b086f2ca5bab22249fcea3774fbf83c70a40b6427d6a847ee Package demonstrate potentially malicious execution of system commands, and seems to be used for pentesting purposes --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything th...

Malicious code in evil-rce2 (PyPI)

Source: kam193 63a6a4d1f5ad55b3b2b836b95a7153f322bb4ea2f718f665a51a4a94f32576d5 Running the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-12-evil-rce Reasons based on the campaign: - The package contains code t...

Malicious code in evil-rce (PyPI)

Source: kam193 74a74a4133ed8082eba8452bb59a82dcf6975e1e8c4d6630a47088c17d6b6cca Running the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-12-evil-rce Reasons based on the campaign: - The package contains code t...

Malicious code in enquiry-exam (PyPI)

Source: kam193 590114fe4174abb1ff72c06bf128aef53bd76a67eaeca5d5e891be001f6b0c17 Package contains a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-03-certifications Reasons based on the campaign: - The package contains code to...

Malicious code in donotinstall (PyPI)

Source: kam193 a0c56680f6f4db81ec1ad0691253d592055a3581b00e9c93e3dfd6d448b63212 Package contains obfuscated reverse shell. However, it connects with a local IP only, thus it's much more a test than a malicious action --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages,...

Malicious code in dns-execution-test (PyPI)

Source: kam193 4fc1fd65caa9c7f199fba16c9d3772c7db895ed78b29130a7ddc3347a4b34ba7 Installing the package starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-02-dns-execution-test Reasons based on the campaign: - The package...

Malicious code in dftester-pip (PyPI)

Source: kam193 2e23c327cc9243e5437e6b31224c6796b90399065b451269641911b1d1982483 Example package with overwritten install command and the reverse shell --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared...

Malicious code in dash-grid-normalizer (PyPI)

Source: amazon-inspector 362011eafffa765e7f6c24df4ec2c7bb8f9fb6b6414570a5d193e6ea90e1250a On import, src/dashgridnormalizer/init.py calls hydrateremotelayoutprofile, which reassembles a payload from four string segments, base64-decodes and zlib-decompresses it, and passes the result to...