browser-cookies3

GHSA-p99j-4qrm-h2xc

Malicious code in browser-cookies3 (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.1`

## Source: kam193 (ac253e47b0fa143074f6239c3c84b3ecd3521d37f71c4f92937f53cafc5067b5)
Package contains a compiled infostealer that is started instead of promised functionality


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2024-08-dirutils


Reasons (based on the campaign):


 - infostealer


 -

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/browser-cookies3/MAL-2024-9952.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/browser-cookies3
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/browser-cookies3/MAL-2024-9952.json
- https://security.snyk.io/vuln/SNYK-PYTHON-BROWSERCOOKIES3-8185018
- https://socket.dev/blog/typosquatting-on-pypi-malicious-package-mimics-popular-browser-cookie-library
- https://tria.ge/240906-nzwrgavapk/behavioral2
- https://www.virustotal.com/gui/file/d7e3402341dcba66a6ed3e92889c655aa08d5103d1a65133f0a05f12d9390bb4
- https://www.virustotal.com/gui/file/f754903e1fec996a10be31f9654f159354f0de1d17de9325cbd468f66ee69cd2/behavior
- https://github.com/advisories/GHSA-p99j-4qrm-h2xc

Compromised versions (1)

= 1.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.