kertash

GHSA-vrwv-hh86-qq4j

Malicious code in kertash (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.1.5`

## Source: kam193 (3cb3ef6da7e0d1c1461bb944c5ff0e356b73e52d271afa9e94435097f1d0764f)
When using methods from the package, it downloads an obfuscated code from Github and puts it in multiple localisation. While it appears that this code is used to perform action user requested, deobfuscation reveals exfiltrating user's data instead.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2025-08-kertash


Reasons (based on the campaign):


 - exfiltration-generic


 - A Telegram webhook is used to send collected data.


 - obfuscation


 - action-hidden-in-lib-usage

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/kertash/MAL-2025-191774.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/kertash
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/kertash/MAL-2025-191774.json
- https://github.com/advisories/GHSA-vrwv-hh86-qq4j

Compromised versions (1)

= 0.1.5

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.