qoeoe

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (d1e6c0c50dfb4a99c6e8b2ca640cadd33877e737479d8739d5db5b39271bc967)
The package ships a single module qoeoe/starts.py whose entire body is a lambda that base64-decodes a reversed ~108 KB string literal and passes the resulting ~80 KB opaque blob directly to exec(). qoeoe/__init__.py imports starts unconditionally, so the decoded payload runs on any `import qoeoe`. The package has an empty README, no advertised functionality, no readable API surface, and no legitimate reason to hide its module body behind reversed+base64 obfuscation piped to exec. This is the import-time loader/dropper shape: arbitrary attacker-controlled code executes on the installer's Python interpreter as soon as the package is imported.

## Source: kam193 (fb52479116026de0be08479d69a7e28915fc9add4b66ff31152b0a47dc256977)
The provided functionality hides code that exfiltrates files to a remote location.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-09-asti


Reasons (based on the campaign):


 - files-exfiltration


 - action-hidden-in-lib-usage


 - target:android

Compromised versions (1)

• 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.