instaread

MAL-2024-12292

Malicious code in instaread (PyPI)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (792748013463fb0303ff6033b47dcb48c23dc944d5075a8859b6997eafd47a56)
The file bc2556d1c1ea2a2d00.js contains an AdWare LNKR, this file is included in read_article.html template and effectively used when the user requests to see the downloaded article in the webbrowser (function "read" from instaread.py). Note: the template may have been copied from the website, so 'maybe' including adware is unintentional.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2024-10-old-instaread


Reasons (based on the campaign):


 - action-hidden-in-lib-usage


 - The package is used to advertise a service or product.

Compromised versions (4)

0.1.3
0.1.2
0.1.1
0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.