VYPR
← All malware advisories

pypi · Malicious package advisory

Malware

conn-utils

MAL-2025-191706

Malicious code in conn-utils (PyPI)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (25be0eaa51dd4c4ba03afd81b4cfad938ceb07dacb0195a9179b46413178e086)
Already during the installation, the file with slightly obfuscated code is loaded and starts exfiltrating information about the host. It especially targets information about additional indexes configured for pip. Data is exfiltrated using DNS queries


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2025-03-conn-utils


Reasons (based on the campaign):


 - exfiltration-generic


 - obfuscation

Compromised versions (2)

  • 1.6.10
  • 1.6.11

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.