soopsocks

GHSA-5jvh-q5g4-v7qr

Malicious code in soopsocks (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.2.7`

## Source: kam193 (adcaa2cfcfa52c7c1ed664a9389ba0bd0ddd2716ea4c475b22bcd2f62bc1ab95)
The package promise creating a SOCKS proxy and report the server to a Discord webhook. And indeed appears to do so, but the attached autorun service seems to be a malware


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2025-09-soopsocks


Reasons (based on the campaign):


 - malware

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/soopsocks/MAL-2025-191872.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/soopsocks
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/soopsocks/MAL-2025-191872.json
- https://research.jfrog.com/post/check-your-socks-a-deep-dive-into-soopsocks-pypi
- https://www.virustotal.com/gui/file/d1cb05c0e57ceb142a5e1117df4359a62df3a01f708561f4714e10e8f2af1f0d/detection
- https://github.com/advisories/GHSA-5jvh-q5g4-v7qr

Compromised versions (1)

= 0.2.7

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.