hellopythopy

MAL-2024-11606

Malicious code in hellopythopy (PyPI)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (9d4a25ed4b69dc1e63e0582d7ec37abf5fb0e5adb1e844dda88557faa06bd827)
Packages that might be part of testing for pentesting / malicious activity / joy, with suspicious activity that does not present any real harm.


---

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.


Campaign: GENERIC-simple-tests


Reasons (based on the campaign):


 - The package overrides the install command in setup.py to execute malicious code during installation.

Compromised versions (11)

0.8.0
0.9.0
0.11.0
0.14.0
0.16.0
0.19.0
0.2.0
0.3.0
0.1.0
0.4.0
0.5.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.