easyreg @1.0.0
Vulnerability report · Last retrieved from osv.dev August 14, 2026 at 12:32 PM UTC
OSV ID
MAL-2026-932
Ecosystem
pypi
Summary
The package pretends to be a development helper but, in fact, downloads a remote executable. Dynamic analysis reveals actions like disabling Windows Defender and interest in cryptocurrencies as well as using Telegram as C2. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-02-pywin-simple-gui Reasons (based on the campaign): - impersonation - Downloads and executes a remote executable. - modify-system-without-consent - crypto-related
Source: kam193 (2897582bf6c0c29d4fc679ee338263019a8a5d5bcb66b5ae2c59454d6c967d6a)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.