python-bitget-api@3.3.5

Summary

Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by multiple vendors. Package impersonate the legitimate "python-bitget". --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-12-python-bitget-api Reasons (based on the campaign): - typosquatting - obfuscation - clones-real-package - dependency-confusion - crypto-related - impersonation - Downloads and executes a remote malicious script.

Source: kam193 (cac6988c3746b27c0cc34a156657431c2a0c0c36de45c6b88a00130d30dfd66e)