dirutils

GHSA-cw78-h9vx-mg5q

Malicious code in dirutils (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1`

## Source: kam193 (c67eead763edc5b56dadc5bfcec545f8799586732b861a6e661050d1165bc7e8)
Package contains a compiled infostealer that is started instead of promised functionality


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2024-08-dirutils


Reasons (based on the campaign):


 - infostealer


 -

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/dirutils/MAL-2024-9967.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/dirutils
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/dirutils/MAL-2024-9967.json
- https://tria.ge/240906-nzwrgavapk/behavioral2
- https://www.virustotal.com/gui/file/d7e3402341dcba66a6ed3e92889c655aa08d5103d1a65133f0a05f12d9390bb4
- https://www.virustotal.com/gui/file/f754903e1fec996a10be31f9654f159354f0de1d17de9325cbd468f66ee69cd2/behavior
- https://github.com/advisories/GHSA-cw78-h9vx-mg5q

Compromised versions (1)

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.