browser-cookies1

GHSA-5r25-p7v4-jpw6

Malicious code in browser-cookies1 (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.1`

## Source: kam193 (5cabd14fc21e5314fd1778bac4e49f0cb8a145e773e147666070d85aa60e422c)
Package contains a compiled infostealer that is started instead of promised functionality


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2024-08-dirutils


Reasons (based on the campaign):


 - infostealer


 -

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/browser-cookies1/MAL-2024-9951.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/browser-cookies1
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/browser-cookies1/MAL-2024-9951.json
- https://tria.ge/240906-nzwrgavapk/behavioral2
- https://www.virustotal.com/gui/file/d7e3402341dcba66a6ed3e92889c655aa08d5103d1a65133f0a05f12d9390bb4
- https://www.virustotal.com/gui/file/f754903e1fec996a10be31f9654f159354f0de1d17de9325cbd468f66ee69cd2/behavior
- https://github.com/advisories/GHSA-5r25-p7v4-jpw6

Compromised versions (1)

= 1.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.