colotama

{"modified":"2025-12-31T02:45:15Z","published":"2024-09-29T16:36:08Z","schema_version":"1.7.4","id":"MAL-2024-11560","summary":"Malicious code in colotama (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (fa7312f48aedc863c1eb3377178692b7cb1fe1503114d3cbc6cdc97572b9a6c0)\nThe pyprettifier library has a feature to send out the user home path throuh the logger. It's attached to the __init__ of EmojiConverter class. Other related packages utilize a typosquatting to imitate real packages, and attempts to call the EmojiConverter from pyprettifier, triggering notifying the author about the user's home path.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: 2024-09-pyprettifier\n\n\nReasons (based on the campaign):\n\n\n - typosquatting\n\n\n - The malicious code is intentionally included in a dependency of the package\n\n\n - action-hidden-in-lib-usage\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n## Source: ossf-package-analysis (18c9d3a75d7d00423b531ffce7bf8ecbe34e723046045707f3ce1bd6043255fe)\nThe OpenSSF Package Analysis project identified 'colotama' @ 0.4.8 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"ecosystem":"PyPI","name":"colotama","purl":"pkg:pypi/colotama"},"versions":["0.4.4","0.4.5","0.4.7","0.4.8","0.4.9","0.5.0","0.4.6"]}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/colotama"}],"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","type":"ANALYST","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]},{"name":"ReversingLabs","type":"FINDER","contact":["https://www.reversinglabs.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"reversing-labs","sha256":"6a267b7a9b92a77e1838d93bb8ab55b8ad8aa132bf1f371108a9b3a8a31bd3bb","import_time":"2024-12-09T14:38:42.367077937Z","id":"RLMA-2024-11007","modified_time":"2024-12-09T06:50:01Z","versions":["0.4.4","0.4.5","0.4.7","0.4.8","0.4.9","0.5.0"]},{"source":"ossf-package-analysis","sha256":"18c9d3a75d7d00423b531ffce7bf8ecbe34e723046045707f3ce1bd6043255fe","import_time":"2025-02-10T05:35:47.229602921Z","modified_time":"2024-09-29T16:36:08Z","versions":["0.4.8"]},{"source":"ossf-package-analysis","sha256":"6393d8ebf54de33a6f79256270b507e8302a4326d5572cc9448d62433f830dfa","import_time":"2025-02-10T05:35:47.314378023Z","modified_time":"2024-09-29T16:51:09Z","versions":["0.5.0"]},{"source":"kam193","sha256":"fc95a2119d3cdd55feddcc76a9e9abc6305a7bcc11c531393c641496a4554c3a","import_time":"2025-12-02T22:30:55.952604582Z","id":"pypi/2024-09-pyprettifier/colotama","modified_time":"2024-09-29T18:01:44Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"fa7312f48aedc863c1eb3377178692b7cb1fe1503114d3cbc6cdc97572b9a6c0","import_time":"2025-12-02T23:07:19.142574299Z","id":"pypi/2024-09-pyprettifier/colotama","modified_time":"2024-09-29T18:01:44Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"620ac081dd0c9b0c92e59a4db27aeca43bc1ed090b14c59cb16082f50e2bd9d3","import_time":"2025-12-10T21:38:58.280968638Z","id":"pypi/2024-09-pyprettifier/colotama","modified_time":"2024-09-29T18:01:44Z","versions":["0.4.7","0.4.4","0.4.5","0.4.6","0.4.8","0.4.9","0.5.0"]},{"source":"kam193","sha256":"d59bd47575cd3358dbf6db2ee85b0a07661993f821d40a17ee2f5d71932753b2","import_time":"2025-12-30T22:39:04.275738408Z","id":"pypi/2024-09-pyprettifier/colotama","modified_time":"2024-09-29T18:01:44Z","versions":["0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.4.9","0.5.0"]}]}}