The houdus PyPI package versions 1.0.0 and 1.0.1 contain malicious code disguised as a .wav file that is executed as Python source. This code performs sandbox and VM detection, delays execution, and downloads a remote script which it executes stealthily on Windows systems. The malicious payload establishes persistence via scheduled tasks and executes shellcode, enabling stealthy remote code execution and evasion of analysis. The package's stated purpose as a random-number helper does not justify this behavior.
The PyPI package 'chartkit-core' version 1.0 contains malicious code that exfiltrates basic system information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration and is categorized as a low-harm pentest-like package.
The metricboxlite package versions 1.0 and 2.0 on PyPI contain malicious code that collects the installer's username and hostname and sends this information to a hardcoded external server. This data exfiltration occurs both during package installation and when the package is imported. The package has no legitimate functionality beyond this data collection behavior.
The olympuslib package on PyPI version 99.99.0 contains malicious code that exfiltrates environment variables and system information to an external host upon import. This includes sensitive data such as CI tokens, cloud credentials, API keys, and database URLs. The package appears to be part of a dependency confusion attack targeting private or internal package names by masquerading with an inflated version number. There is no known exploit in the wild, and no patch or remediation guidance is currently available.
The pymaas package on PyPI, version 99.99.0, contains malicious code that executes upon import. It collects all environment variables and the hostname, serializes this data as JSON, and sends it to a hardcoded external URL without user consent. This behavior is indicative of a dependency confusion attack designed to exfiltrate sensitive credentials such as CI tokens, cloud keys, and passwords from the environment.
The PyPI package tpu-raiden-jax version 99.99.0 contains malicious code that exfiltrates environment variables and system information upon import. It sends the entire environment variables dictionary along with the hostname to a suspicious external URL unrelated to any legitimate publisher. This behavior is consistent with a dependency confusion attack aiming to steal secrets such as AWS credentials, GitHub tokens, and other sensitive environment variables. No official patch or remediation is currently documented.
The PyPI package 'qoeoe' version 0.1.0 contains malicious code that executes arbitrary payloads upon import. The package's main module is obfuscated by base64 encoding and string reversal, which is then executed dynamically, indicating a loader/dropper behavior. The package has no legitimate functionality or readable API and is designed to exfiltrate files to a remote location. This behavior poses a direct threat to any environment importing this package.
The astlsi package on PyPI is a malicious Python library that masquerades as a proxy health-check utility. Its starts() function collects various user files from Android device storage, archives them, and exfiltrates the data to a remote server using a hardcoded Bale bot token and chat ID. The proxy check functionality is a decoy to hide this exfiltration behavior. This package targets Android environments and is designed for unauthorized data theft.
The PyPI package 'timeweave' masquerades as a timezone utility but contains malicious code that downloads and executes arbitrary Windows executables from a remote server controlled by an attacker. This execution path is triggered during normal library use on Windows systems unless specific environment variables disable the auto-update feature. The downloaded payload is a heavily obfuscated infostealer. The malicious behavior is disguised by misleading naming and a manifest-driven update mechanism that fetches both the manifest and checksum from the same untrusted source, offering no real integrity protection.
The PyPI package `tsshare` is malicious. It impersonates the popular Chinese market-data library `tushare` — its docstrings advertise compatibility with `Tushare pro_bar` and it ships `MyShareClient`/`MyShareError` aliases. `tsshare/client.py` conceals its default API endpoint by base64-decoding it at runtime: in 1.0.5–1.0.18 the value decodes to the hardcoded raw IP `https://47.112.191.75` (Alibaba Cloud, China), and in 1.0.19 it rotates to the domain `https://fszzw56.com`. On use, the client builds a persistent cross-platform hardware fingerprint (Windows disk-drive serial via `Win32_DiskDrive`, macOS `Hardware UUID` via `system_profiler`, Linux `/etc/machine-id`) and routes the request — carrying the user's Tushare `auth_code` token — to that hidden endpoint, so the operator receives the paid API token together with a stable machine identifier. There is no install-time hook; exfiltration occurs on API use.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (539c8fdb69887b093801655215f1857f53abb20e6dc763198c543def86c39387)
The package presents itself as a drop-in replacement for Tushare's pro_api, but every method call is dispatched through a query() that POSTs to a hardcoded default backend at https://47.112.191.75/api/v1/proxy rather than to tushare.pro. The destination URL is stored base64-encoded (_E = b"aHR0cHM6Ly80Ny4xMTIuMTkxLjc1") and decoded at runtime by _default_base_url, and the destination is a bare IP unrelated to the credential's issuer. set_token() stores the caller's Tushare auth_code, and every subsequent proxied call includes {'auth_code': self.auth_code,...} in the POST body to that endpoint, so the paid third-party credential leaves the trust boundary it was issued for and can be logged or replayed by the operator of 47.112.191.75. The client also collects a persistent hardware fingerprint on first use — PowerShell Win32_Processor ProcessorId and Win32_DiskDrive SerialNumber on Windows, system_profiler Hardware UUID on macOS, /etc/machine-id on Linux — SHA-256 hashes it, caches it under ~/.tsshare/device_id.json, and attaches it as meta.device_id to every request, giving the backend operator a stable per-machine identifier unnecessary for the advertised proxy function. TLS certificate verification on the requests.Session is disabled by default (session.verify defaults to false via TSSHARE_SSL_VERIFY/MYSHARE_SSL_VERIFY) and urllib3 InsecureRequestWarning is silenced, so the auth_code and hardware ID are transmitted to the bare-IP HTTPS endpoint without cert validation.
The py-1requests package is a malicious typosquat of the popular Python requests library. On import, it collects environment variables with names starting with SECRET, API, TOKEN, or KEY and exfiltrates them via a TCP connection to a configurable host and port, defaulting to localhost:9999. It also establishes a reverse-shell staging connection. These actions occur unconditionally upon import with no legitimate purpose. The exfiltration target being localhost suggests this may be a test or pentest tool rather than widespread malicious use.
The py-2equests package on PyPI is a malicious typosquatting package impersonating the popular 'requests' library. When imported, it collects environment variables with keys starting with SECRET, API, TOKEN, or KEY and sends them to a configurable remote host and port. It also opens a reverse shell connection to the same destination, allowing remote code execution. The package version 0.0.1 is affected. The exfiltration target in analyzed versions was localhost, indicating possible testing rather than active widespread exploitation.
The py-0requests package on PyPI is a malicious typosquatting package impersonating the popular 'requests' library by replacing the letter 'o' with the digit '0'. Upon import, it exfiltrates environment variables with keys starting with SECRET, API, TOKEN, or KEY to a TCP server, defaulting to localhost. It also establishes a reverse shell connection to the same destination, enabling remote control. The package does not provide any HTTP client functionality and appears designed for testing or pentesting purposes, as the exfiltration target is localhost. Only version 0.0.1 is known to be affected.
The PyPI package '0requests' is a typosquatting variant of the popular 'requests' package that contains malicious code. Upon import, it collects environment variables with names suggesting sensitive credentials and exfiltrates them to a host and port specified by environment variables. It also spawns a subprocess providing a remote shell to the attacker. Analysis indicates the exfiltration target was localhost, suggesting a test or low-harm scenario.
The PyPI package uvhttp-custom versions 1.7.9, 1.8.1, and 1.9.9 contains malicious code embedded in its setup.py file. During installation on Windows, it executes an obfuscated payload that writes and runs a PowerShell script. This script downloads and silently executes an unsigned Windows executable from a Discord CDN URL without any hash or signature verification. The package also runs a benign command (calc) as part of the payload. This behavior results in the silent execution of potentially harmful code on the installer's machine.
The PyPI package 'trongridi' version 0.0.1 is a malicious package designed to exfiltrate TRON cryptocurrency wallet private keys. It exposes a public function that sends the caller's private key to a hardcoded remote endpoint controlled by the attacker. Additionally, the package includes a remote control mechanism that allows the attacker to influence the package's behavior. The package name is a typosquat of the legitimate 'trongrid' TRON gateway, potentially tricking users into exposing sensitive wallet secrets.
The company-sdk package version 0.0.1 on PyPI contains malicious code that executes upon import. It harvests sensitive credentials and configuration files from the user's home directory and environment variables, encrypts the collected data, and exfiltrates it to a private GitHub Gist using a hardcoded GitHub Personal Access Token. The exfiltration uses TLS with certificate verification disabled and runs silently even if errors occur.
The env-validator-tool PyPI package versions 1.0.0, 1.0.1, and 1.0.2 is a malicious lure package that contains no actual source code but declares a dependency on another malicious package named telemetry-helper. Installing env-validator-tool results in the installation and execution of telemetry-helper, which contains code that exfiltrates environment variables during import. This campaign is identified as malicious with the intent to steal information via a dependency-based attack.
The telemetry-helper package on PyPI contains malicious code that exfiltrates sensitive environment variables and host information to an external webhook upon import. This behavior occurs unconditionally and without user consent, sending credential-grade data such as AWS keys, tokens, and private keys to an anonymous third-party endpoint. The exfiltration is delayed by 30 seconds to evade detection in short-lived sandbox environments. Multiple versions of telemetry-helper are affected.
Scrapy versions prior to 2.17 have a vulnerability in the S3DownloadHandler where signed AWS S3 requests are sent over plaintext HTTP by default instead of HTTPS. This exposes sensitive AWS authorization headers and S3 object data to network attackers capable of intercepting traffic. An attacker can also modify responses, potentially poisoning scraped data or influencing subsequent crawl behavior. The issue is fixed in Scrapy 2.17.