OSV ID
MAL-2024-12224
Ecosystem
pypi
Summary
Packages exfiltrate the diff of the current repository. The code in "main.py" suggests it's not a real attempt to provide AI-generated commit message, but a security research attempting to leverage typosquatting. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: 2024-08-old-bitcommit Reasons (based on the campaign): - exfiltration-generic - typosquatting
Source: kam193 (5bf8fb109bddeaac7b9818f893783456619c44562c50fe26abea906cbc1ef06a)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.