VYPR
← All malware advisories

pypi · Malicious package advisory

Malware

blackspammerbd-v1

GHSA-48xm-8m88-8mw6

Malicious code in blackspammerbd-v1 (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: oracle-using-macaron (d696247c09031d2d4a82b6ec26822f3282f859aeaed36b9ef8a1c42c3f255c19)
The package performs data exfiltration and remote control of the system by generating connection codes, enabling file uploads and downloads, and obfuscation. These actions could allow unauthorized access to sensitive information or remote manipulation of the system.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/blackspammerbd-v1/MAL-2025-2596.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/blackspammerbd-v1/MAL-2025-2596.json
- https://github.com/advisories/GHSA-48xm-8m88-8mw6

Compromised versions (1)

  • = 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.