iamenumerate

GHSA-prrj-m93p-6vrr

Malicious code in iamenumerate (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: kam193 (d673b2612401a11ff219f59a9ca15986b4ce10d098f08d4beb5fbc9dc79ec554)
This one package is clearly created as part of the campaign, but the malicious code from the previous version has been removed (no other changes). It is anyway dangerous as most probably will be updated with the malicious code later


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2025-08-aws-enumerate


Reasons (based on the campaign):


 - exfiltration-generic


 - action-hidden-in-lib-usage


 - exfiltration-credentials

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/iamenumerate/MAL-2025-41688.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/iamenumerate
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/iamenumerate/MAL-2025-41688.json
- https://github.com/advisories/GHSA-prrj-m93p-6vrr

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.