Skip to content

MALICIOUS (1) package from Python Package Index.

  1. The campaign has clearly malicious intent, like infostealers.

kingwork-test

Affected versions: (1) 1.0.1

  1. Version numbers are usually added automatically. In most cases, the packages listed here were created only to distribute malicious code.

The package contains the same code to deobfuscate code as in previous packages, but the malicious code itself is missing

Campaign data

Campaign information may not always be 100% accurate for every related package.

Campaign description

Package contains obfuscated code that exfiltrate basic data and awaits for commands from the remote server to execute them. This is a malicious copy of legitimate https://pypi.org/project/coinanalyse/ package.

See more details on the campaign page.

backdoor

Campaign targets backdoor.

clones_real_package

The package is a clone of a legitimate package or library, but with malicious code added.

crypto-related

Malicious activity is related to cryptocurrencies or blockchain, e.g. stealing crypto wallets.

obfuscation

Code uses obfuscation techniques to hide its true purpose.

remote_commands

The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

typosquatting

The package name is an typosquatting variant of a popular package.

Look up in other services

  1. May not be available. See more in pypi-json-data repository.
  2. Open Source Insights project, provided by Google.
  3. Service from Socket.dev, a cybersecurity company.
  4. Spectra Assure Community, a service from ReversingLabs, a cybersecurity company.
  5. Service from Snyk, a cybersecurity company.