selenium-plugin

GHSA-vmx3-rjc2-c8q3

Malicious code in selenium-plugin (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: kam193 (6e002fd5736f780c2fc01668d4e37d008d211fa2547b96cb960b11edd5b87d64)
During installation or importing, the package downloads a small executable and register autostart of its. While it's hard to get the full activity of the executable, it does download what appears to be an encrypted data from GitHub repo full of suspicious files, including bitcoin miners.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2024-12-selenium-plugin


Reasons (based on the campaign):


 - modify-system-without-consent


 - peristence-autorun


 - dependency-confusion

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/selenium-plugin/MAL-2025-982.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/selenium-plugin
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/selenium-plugin/MAL-2025-982.json
- https://tria.ge/241228-3gv5jsvqhn/behavioral1
- https://github.com/advisories/GHSA-vmx3-rjc2-c8q3

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.