OSV ID
MAL-2025-6540
Ecosystem
pypi
Summary
While described as educational package to simulate post-exploitation environment, the malware is active and once started, automatically attempts to exfiltrate sensitive data (credentials, cookies, etc.) and places a Discord implant. The remote target is hard coded in the code. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-06-mainx Reasons (based on the campaign): - obfuscation - infostealer - files-exfiltration - exfiltration-credentials - exfiltration-browser-data - peristence-autorun - The package contains code to detect if it is running in a sandbox environment.
Source: kam193 (6a77aad2f42165ec9582f04fffab948f6a1125564e34f4d09c8d089b2708d8d2)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.