Skip to content

HIGHLY_SUSPICIOUS (1) package from Python Package Index.

  1. Packages that are likely malicious, but due to the obfuscation level, lack of time or clear indicators it's hard to say what exactly they do; the highest risk of false positives.

thispackagedoesnotexist

  1. May not be available. See more in pypi-json-data repository.
  2. Version numbers are currently not tracked. Assume all versions are affected.

Campaign data

Campaign information may not always be 100% accurate for every related package.

Campaign description

Packages contain potentially malicious, RAT-like functionality (creating reverse shell, stealing cookies, etc.), but do not run it. It could be a preparation for something or building a red-team-like tools

See more details on the campaign page.

backdoor

Campaign targets backdoor.

exfiltration_browser_data

Campaign targets exfiltration_browser_data.

exfiltration_generic

Campaign targets exfiltration_generic.

remote_commands

The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

revshell

The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.