jython-file

GHSA-w76j-5f7j-h2v8

Malicious code in jython-file (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.999999999`

## Source: kam193 (fc56f6ba4b75b25d4289c3aa3cb1d05f9b1d7bbfacf00b11e270d76ba87a1a3e)
Package attempts to load in an obfuscated way a code from a file (not included in the package) as well as inject a dynamic library to the Python dynamic libs directories.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2025-07-jython-file


Reasons (based on the campaign):


 - modify-system-without-consent


 - obfuscation

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/jython-file/MAL-2025-191771.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/jython-file
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/jython-file/MAL-2025-191771.json
- https://github.com/advisories/GHSA-w76j-5f7j-h2v8

Compromised versions (1)

= 0.999999999

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.