easyaillm

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b6268f175708584b9c3de408c80de3dc1162f4d1ddedb1ce6201b90f409b0dea)
On `pip install easyaillm`, setup.py runs `exec(base64.b64decode(...))` which decodes to code that fetches https://pastebin.com/raw/hEF5HaFc, treats the response body as a second URL, downloads that URL's bytes to `pkg_installer.exe`, and executes it via `os.system('cmd /c pkg_installer.exe')`. The attack stages are concealed behind a base64 blob and `exec()` indirection, while the package metadata advertises an unrelated LLM/Roblox API purpose as cover. The pastebin source is mutable and anonymous, allowing the operator to swap the second-stage URL and ultimately the executed binary at any time. Installing this package on Windows results in arbitrary attacker-controlled code execution on the installer's machine.

## Source: kam193 (a08d3871109fa50918608928ea7aaa533e5f99ac68cb20cbaa9558836f3d44bd)
During installation, the obfuscsted code attempts to download and start a malicious executable. The published versions contained issues preventing successful downloading, but it was possible to recover the intended executable during the analysis.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-06-easyaillm


Reasons (based on the campaign):


 - Downloads and executes a remote executable.


 - obfuscation


 - malware


 - tool:mshta

Compromised versions (2)

• 2.0.15
• 2.0.16

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.