instaread

GHSA-4q98-v427-jhpq

Malicious code in instaread (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.1.3`

## Source: kam193 (792748013463fb0303ff6033b47dcb48c23dc944d5075a8859b6997eafd47a56)
The file bc2556d1c1ea2a2d00.js contains an AdWare LNKR, this file is included in read_article.html template and effectively used when the user requests to see the downloaded article in the webbrowser (function "read" from instaread.py). Note: the template may have been copied from the website, so 'maybe' including adware is unintentional.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2024-10-old-instaread


Reasons (based on the campaign):


 - action-hidden-in-lib-usage


 - The package is used to advertise a service or product.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/instaread/MAL-2024-12292.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/instaread
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/instaread/MAL-2024-12292.json
- https://www.virustotal.com/gui/file/bf7d5b37aa1365e5e79376921304dde4767d1055fc62cc898f5b6b02b5607614/detection
- https://github.com/advisories/GHSA-4q98-v427-jhpq

Compromised versions (1)

= 0.1.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.