scrambleeer

GHSA-jx7v-9c55-jw2v

Malicious code in scrambleeer (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.1.0`

## Source: kam193 (52d5b1e99e57b038247cf3b7f86a7514e75275a095ca3f3cf044d80cbe999472)
When using the provided library, the code starts a reverse shell to a hardcoded location.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-08-scrambleeer


Reasons (based on the campaign):


 - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.


 - action-hidden-in-lib-usage

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/03e1016b4270e6fe79c7cdc1288ba6dc9bbeccd0/osv/malicious/pypi/scrambleeer/MAL-2026-14350.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/scrambleeer
- https://github.com/ossf/malicious-packages/blob/03e1016b4270e6fe79c7cdc1288ba6dc9bbeccd0/osv/malicious/pypi/scrambleeer/MAL-2026-14350.json
- https://github.com/ossf/malicious-packages/blob/2e21bf6d54d5fd4fc49cbecf6c55a7d0420028e6/osv/malicious/pypi/scrambleeer/MAL-2026-14350.json
- https://pypi.org/project/scrambleeer/0.1.1
- https://github.com/ossf/malicious-packages/blob/51911d234a84078e05bdf54c4b86161625e68d64/osv/malicious/pypi/scrambleeer/MAL-2026-14350.json
- https://pypi.org/project/scrambleeer/0.1.0
- https://github.com/advisories/GHSA-jx7v-9c55-jw2v

Compromised versions (1)

= 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.