updateuuid4

GHSA-xhv7-rpx7-hxg7

Malicious code in updateuuid4 (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.1.2`

## Source: kam193 (2c45f904631a26aae94cafeeac5ea0f7efe0fc5d4f46dea48da17dcb766111d5)
The package, with an innocent looking name, has as the only functionality reporting to a Telegram channel given username and password. The functionality is in the "HeadersUpdate" class, that also looks like attempting to look innocent. The code does nothing more than reporting given credentials through a bot using the name "hitlercute_bot".


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2025-02-updateuuid4


Reasons (based on the campaign):


 - infostealer

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/updateuuid4/MAL-2025-191917.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/updateuuid4
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/updateuuid4/MAL-2025-191917.json
- https://github.com/advisories/GHSA-xhv7-rpx7-hxg7

Compromised versions (1)

= 0.1.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.