pycrackhash

GHSA-5994-gffh-3rh8

Malicious code in pycrackhash (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.1.1`

## Source: kam193 (b3323afe460298d80a354497acdd641752c5fb6bce2dce3d7e7625d7a46f1d7c)
When using methods from the package, it downloads an obfuscated code from Github and puts it in multiple localisation. While it appears that this code is used to perform action user requested, deobfuscation reveals exfiltrating user's data instead.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2025-08-kertash


Reasons (based on the campaign):


 - exfiltration-generic


 - A Telegram webhook is used to send collected data.


 - obfuscation


 - action-hidden-in-lib-usage

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/pycrackhash/MAL-2025-191832.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/pycrackhash
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/pycrackhash/MAL-2025-191832.json
- https://github.com/advisories/GHSA-5994-gffh-3rh8

Compromised versions (1)

= 0.1.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.