conn-utils

GHSA-j3c8-9hhp-c6r6

Malicious code in conn-utils (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.6.10`

## Source: kam193 (25be0eaa51dd4c4ba03afd81b4cfad938ceb07dacb0195a9179b46413178e086)
Already during the installation, the file with slightly obfuscated code is loaded and starts exfiltrating information about the host. It especially targets information about additional indexes configured for pip. Data is exfiltrated using DNS queries


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2025-03-conn-utils


Reasons (based on the campaign):


 - exfiltration-generic


 - obfuscation

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/conn-utils/MAL-2025-191706.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/conn-utils
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/conn-utils/MAL-2025-191706.json
- https://github.com/advisories/GHSA-j3c8-9hhp-c6r6

Compromised versions (1)

= 1.6.10

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.