pypi
Malicious botbooster @0.0.3
Vulnerability report · Last retrieved from osv.dev August 14, 2026 at 9:32 AM UTC
OSV ID
MAL-2026-1097
Ecosystem
pypi
Summary
When using the provided function, code exfiltrates the sensitive token from local settings.json to the hardcoded location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-02-old-botbooster Reasons (based on the campaign): - exfiltration-credentials
Source: kam193 (0ac97422a8ea78df8c5538d0dbada7aad5720510773f1855cf5e4b5a9cbc56cb)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.