Skip to content

PROBABLY_PENTEST (1) campaign cataloged at 2025-10-19(2).

  1. Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
  2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2025-10-wangzhou183

Packages that either reports home installation, simulate malicious activity or imitate Roblox API wrapper.

Abuse categories

override_install

The package overrides the install command in setup.py to execute malicious code during installation.

URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.

  • hxxps://discord.com/api/webhooks/1429446372410654800/CmzQaPJypMtuap4BqDzebkFZfSTVJoFRjj1UGfL_MZ1f7zTagpa5QkgAVC_WOVTA3CMV

Packages in the campaign

campaign:2025-10-wangzhou183