pingdomv3

GHSA-gxhh-m7mp-3wv4

Malicious code in pingdomv3 (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.1.0`

## Source: kam193 (7b1fe453efd67c0475761e84e07029086b389cedfb367f38826c0d3339b62b01)
---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2024-04-pingdomv3


Reasons (based on the campaign):


 - reuse-removed-name


 - obfuscation

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/pingdomv3/MAL-2024-5479.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/pingdomv3
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/pingdomv3/MAL-2024-5479.json
- https://jfrog.com/blog/revival-hijack-pypi-hijack-technique-exploited-22k-packages-at-risk/#real-world-revival-hijack-pingdomv3
- https://security.snyk.io/vuln/SNYK-PYTHON-PINGDOMV3-7911575
- https://thehackernews.com/2024/09/hackers-hijack-22000-removed-pypi.html
- https://github.com/advisories/GHSA-gxhh-m7mp-3wv4

Compromised versions (1)

= 1.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.