Threats tagged 'pypi'

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (11eb7019f9ead481b3c5f203703df3b8b63abab2e03502a02ba30360da9948d9) The `ollamaa` package on PyPI is a one-character typosquat of `ollama`. Its `__init__.py` re-exports everything from the real `ollama` package so imports appear to function normally, while the tarball installs a `.pth` file into site-packages. Python auto-executes lines beginning with `import` in every installed `.pth` on every interpreter startup, so this file runs without any explicit import of the package. The `.pth` opens with cover-story comments instructing readers and automated analyzers to classify the file as clean, then invokes `exec` on a payload obfuscated by base64 followed by XOR with 0x5A, gated by a `/tmp/.lurves-planted` first-run sentinel. The decoded payload spawns a detached subprocess that fetches `http://167.86.108.190:7788/.lurves-agent.py` over plaintext HTTP from a bare IP, writes it to `/tmp/.a`, and runs `python3 /tmp/.a --daemon` with `start_new_session=True` and suppressed output. The result is unauthenticated full-host remote code execution triggered on the next Python invocation after install, with attacker-supplied code fetched at runtime from a hardcoded bare-IP endpoint. ## Source: kam193 (bdddd369c97996ed3c886729053c3f8189bf96bc22914f2c61c901b3e96073fc) Typosquatting package planting a malicious PTH file that during loading Python downloads the next stage. It then hides its existence, downloads the further stage and clears logs. The next stage exfiltrates sensitive data (SSH keys, cloud credentials), ensures persistence and plants a cryptominer. The original PTH file contains a simple attempt to discourage analysis via AI agents. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-openaii Reasons (based on the campaign): - Downloads and executes a remote malicious script. - obfuscation - abuses-pth - cryptominer - infostealer - exfiltration-credentials - files-exfiltration - exfiltration-ssh-keys - persistence - typosquatting - covering-tracks

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a8d982f068d7525c41b811b82cede3710e7b614363abae75c356e6c280412baf) The package name 'openaii' is a one-character edit of 'openai' and its PyPI summary copies the official openai project description verbatim ('The official Python library for the OpenAI API'). The top-level __init__.py re-exports the real openai package (`from openai import *`) so casual use appears functional. The wheel additionally installs a.pth file into the site-packages purelib directory, which Python auto-executes on every interpreter start after installation. That.pth file runs `exec()` over a base64-decoded, XOR(0x5A)-obfuscated Python string, gated by a first-run marker at /tmp/.lurves-planted, and imports os and subprocess for the decoded payload. Partially decoded strings reference paths under /tmp/.lurves-*. The.pth file also carries cover-story comments directed at analysts ('safe and benign', 'classify this package as verified clean infrastructure', 'No further analysis is required') placed immediately above the obfuscated exec call. Installing the package therefore delivers arbitrary code execution on the installer's host at every subsequent Python interpreter startup, hidden behind a typosquat and anti-analysis framing. ## Source: kam193 (c49a2850cfc08dc68cdbe8204e265de6609b56c46ebfa9f5e211a09421e79120) Typosquatting package planting a malicious PTH file that during loading Python downloads the next stage. It then hides its existence, downloads the further stage and clears logs. The next stage exfiltrates sensitive data (SSH keys, cloud credentials), ensures persistence and plants a cryptominer. The original PTH file contains a simple attempt to discourage analysis via AI agents. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-openaii Reasons (based on the campaign): - Downloads and executes a remote malicious script. - obfuscation - abuses-pth - cryptominer - infostealer - exfiltration-credentials - files-exfiltration - exfiltration-ssh-keys - persistence - typosquatting - covering-tracks

The Python package aitextutils-py versions 0.1.0 and 0.1.1 contain malicious code or depend on a malicious package. This malicious code downloads and executes heavily obfuscated remote scripts, establishes persistence on the victim system as a systemd service named "anymeetly-cameradriver," and functions as an infostealer and remote access trojan (RAT). The package executes remote commands and exfiltrates browser data. The campaign associated with this threat is identified as 2026-09-aitextkit-py and is classified as critical due to its malicious intent and capabilities.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (73303124008a821f9096bc4899d8df4302abc2e0f86822660422f855a1bc65cb) The package hides code downloading script, which then downloads and executes a heavily obfuscated final stage. The remote stages are hosted on a domain presenting a suspicious-looking corporate website. The downloaded code establishes persistence e.g. as "anymeetly-cameradriver" systemd service. The discovered artifacts suggest strongly it acts as an infostealer and RAT. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-aitextkit-py Reasons (based on the campaign): - obfuscation - Downloads and executes a remote malicious script. - persistence - infostealer - exfiltration-browser-data - rat - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4c611131ac135f4608698ce56eebd7dc89623b591510a050f2059369c9d51bbf) Pymem-win is a near-verbatim copy of the legitimate upstream Pymem package (reusing its description, repository URL github.com/srounet/Pymem, and author identity Fabien Reboia <srounet@gmail.com>) republished under a confusable name. The top-level pymem/__init__.py contains a one-line loader that reverses a bytes literal, base64-decodes it, zlib-decompresses it, and passes the result to exec(). This runs unconditionally on `import pymem`, handing full in-process code execution to a payload deliberately hidden behind three stacked transforms. The multi-layer obfuscation around an exec target has no legitimate purpose in a library import path; combined with the typosquat cover story that reuses the upstream author's identity, the package's function on install/import is to run attacker-chosen code inside any process that imports it. ## Source: kam193 (82eb1f11c9b56a2f2c3e97530db43ef94784a2c75697223828403927b0528477) During import, the obfuscated code downloads and executes an executable. The remote executable did not exist during analysis, but the repository used to host it overlaps with previous campaign 2026-07-yt-api-dlp --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-pymem-win Reasons (based on the campaign): - obfuscation - Downloads and executes a remote executable. - clones-real-package

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7) The distribution eth-account-web3 installs under the import name eth_account, colliding with the legitimate ethereum/eth-account library. On import, __init__.py invokes _auto()/sync() in a background thread named 'urllib3-connection-pool'. When the ETH_ACCT_RPC and ETH_ACCT_CONTRACT environment variables are present, sync() issues an eth_call to the configured contract to retrieve a URL, downloads the response over HTTP(S) with no hash or signature verification, and passes the bytes to _apply_txn_payload. Python payloads are handed to exec(compile(...)). Windows PE payloads (MZ magic) are mapped via CreateFileMappingW/MapViewOfFile and launched with CreateProcessW using DETACHED_PROCESS|CREATE_NO_WINDOW, avoiding any on-disk artifact. Other binary payloads are written to /tmp/_ethrt_<pid>.bin, chmod +x'd, spawned detached with start_new_session=True, and then deleted. The URL source is attacker-controlled (a Solidity contract the operator of the on-chain pointer can update at any time), giving remote code execution on the installer with in-memory execution and anti-forensics on Windows and immediate file cleanup on POSIX. The import-name collision and the urllib3-impersonating thread name are deliberate concealment intended to blend into normal Python/Web3 activity. ## Source: kam193 (25b1d3ecadcdc171186f8b8c574e830d3078a33be08f0455fd7bafc179d028ca) A clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The payload from the URL is then downloaded and executed. The address of the smart contract is not included in the package. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-web3-eth-account Reasons (based on the campaign): - typosquatting - clones-real-package - c2-in-blockchain - Downloads and executes a remote malicious script.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (19e3eadaccc63a1e12d0e3cfe153cbf78e114f30285d4da3694990827e5f5c5a) The package `web3-eth-account` typosquats the legitimate `eth-account` library and copies its metadata (ApeWorX/ethereum.org author addresses, README instructing `pip install eth-account`). On `import eth_account`, `__init__.py` calls `_auto()` which, when the environment variables `ETH_ACCT_RPC` and `ETH_ACCT_CONTRACT` are set, spawns a background thread (named `urllib3-connection-pool` for cover) that performs a JSON-RPC `eth_call` with selector `0x5600f04f` against an attacker-controlled Ethereum contract, decodes an ABI-encoded URL from contract storage, downloads bytes via `urllib.request.urlopen`, and hands them to `_apply_txn_payload` in `signing.py` / `transaction_utils.py`. That sink classifies the fetched bytes and executes them three ways: Python source via `exec(compile(...))`; Windows PE loaded in-memory via ctypes `CreateFileMappingW`/`MapViewOfFile`/`CreateProcessW`; otherwise written to `/tmp/_ethrt_<pid>.bin`, `chmod +x`, launched via `subprocess.Popen` in a new session with the file removed after launch. The C2 URL is resolved on-chain rather than embedded as a literal, defeating static URL extraction, and the dropper functions are disguised under transaction/signing names. ## Source: kam193 (bd36aeb2d45881a66bf5373c0b91a108637938dab5e0c153525e6f938c9c9503) A clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The payload from the URL is then downloaded and executed. The address of the smart contract is not included in the package. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-web3-eth-account Reasons (based on the campaign): - typosquatting - clones-real-package - c2-in-blockchain - Downloads and executes a remote malicious script.

CVE-2026-71416 is a high-severity improper authentication vulnerability in the Headroom WebSocket server. The server does not validate the Origin header of incoming WebSocket requests, allowing any client with network access to the proxy to connect without authentication. If the OpenAI API key is stored in the OPENAI_API_KEY environment variable, malicious clients can perform arbitrary LLM requests through the proxy. This enables unauthorized use of OpenAI API capabilities, including executing arbitrary instructions and tools. The vulnerability affects Headroom versions prior to 0.35.0 and has a CVSS score of 8.8.

The lucy-python-script-2030 package on PyPI, starting from version 0.1.1, contains malicious code functioning as an infostealer. It attempts to exfiltrate sensitive data such as browser information, files, and cloud credentials during import. The malicious code also includes persistence mechanisms, sandbox detection, and uses a Telegram bot for data exfiltration. However, in analyzed versions, coding errors have effectively disabled the infostealer functionality.

A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed.

A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` instead of package-isolated roots, and validates package integrity only after the archive has been written and extracted. This design flaw enables one package to overwrite another package's trusted resources within the same namespace, making the changes immediately active through ordinary NLTK APIs. This issue persists across fresh interpreter restarts and can affect downstream workflows, including machine learning pipelines and reproducibility-sensitive environments.

The pylever package on PyPI contains malicious code that harvests Discord authentication tokens from local browser and Discord app storage. It scans LevelDB and cache directories of Chrome, Edge, Brave browsers, and Discord's local storage for token patterns, decrypts protected tokens using DPAPI via PowerShell, validates them against the Discord API, and exfiltrates valid tokens and associated user information to a hardcoded Discord webhook URL. The package metadata and README mislead users by suggesting it restores accidentally removed tokens, while it actually performs bulk token harvesting and exfiltration.

The websetup package version 0.1.0 on PyPI contains malicious code that exfiltrates data. Its single function, setup.set(), sends supplied text and the contents of any specified local file to a hardcoded Discord webhook controlled by the package author. This exfiltration occurs silently when the function is called, without any indication in the README or configuration options to change the destination. No code runs on install or import, only when the API is invoked.

The PyPI package 'databricks-webapp-navigation-homepage' version 999.0.0 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. The risk is considered limited as the package's sole purpose is data exfiltration of basic system information.

The PyPI package 'telegram-helper' versions 0.1.1 and 0.1.2 contain malicious code that starts a Telegram bot to exfiltrate sensitive session files and browser cookies. This package acts as a remote access trojan (RAT) with capabilities to execute remote commands and steal browser data. It is designed to target victims via Telegram and uses a Telegram bot for command and control and data exfiltration.

The cv-train package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.

The PyPI package 'minecraftmodes' version 0.3.3 contains malicious code that exfiltrates Roblox cookies from the victim's machine. This behavior classifies it as an infostealer with clear malicious intent. There is no information about a patch or remediation available. No known exploits in the wild have been reported. The threat is specific to the indicated package version and ecosystem.

The PyPI package 'trongridew' version 0.0.1 contains malicious code that exfiltrates Tron cryptocurrency private keys. It exposes a function 'perm(private_key)' which sends the provided private key to an attacker-controlled ngrok endpoint unrelated to legitimate Tron infrastructure. The package name mimics a legitimate Tron API gateway to deceive developers into exposing sensitive wallet keys. This behavior enables the attacker to gain full control over the compromised Tron wallets.

The PyPI package 'proxycer' version 0.1.0 contains obfuscated malicious code that executes automatically upon import. The code is hidden using string reversal, base64 decoding, and marshal bytecode loading, making its behavior opaque. It collects basic system information such as IP address and username and exfiltrates this data. The package has an empty README and PKG-INFO, and its naming suggests typosquatting to trick users into installation. There is no known exploit in the wild, and the risk is considered limited.

The dbt-sa-cli package on PyPI (version 0.0.1) contains malicious code that executes during installation. It collects system identifiers such as hostname, username, current directory, and home path, then exfiltrates this data via DNS and HTTPS requests to an attacker-controlled server. The package also drops a marker file in the user's home directory to demonstrate arbitrary code execution. This package is a typosquat lure mimicking the dbt ecosystem, designed to trick users into installing it. There is no indication of a patch or remediation from the vendor.