cryptograohy

{"modified":"2025-12-11T09:27:52Z","published":"2024-09-28T16:06:10Z","schema_version":"1.7.4","id":"MAL-2024-11568","summary":"Malicious code in cryptograohy (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (67095679f8af3205e005b17a996da2ba17789715d7c66e4fcf31d8c387b85c00)\nThe pyprettifier library has a feature to send out the user home path throuh the logger. It's attached to the __init__ of EmojiConverter class. Other related packages utilize a typosquatting to imitate real packages, and attempts to call the EmojiConverter from pyprettifier, triggering notifying the author about the user's home path.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: 2024-09-pyprettifier\n\n\nReasons (based on the campaign):\n\n\n - typosquatting\n\n\n - The malicious code is intentionally included in a dependency of the package\n\n\n - action-hidden-in-lib-usage\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n## Source: ossf-package-analysis (69c9f05e42e277434eb37e4dddb268f3144eb27cb1de261c86cd396f7b1c9d14)\nThe OpenSSF Package Analysis project identified 'cryptograohy' @ 0.5.6 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"ecosystem":"PyPI","name":"cryptograohy","purl":"pkg:pypi/cryptograohy"},"versions":["0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.7","0.7.0","0.7.1","0.6.5","0.6.6"]}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/cryptograohy"}],"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","type":"ANALYST","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]},{"name":"ReversingLabs","type":"FINDER","contact":["https://www.reversinglabs.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"reversing-labs","sha256":"46fc867d84bea76cc43b2bc729531ba57bdfb586a25cbdff404caa24e3f0d674","import_time":"2024-12-09T14:38:42.766062237Z","id":"RLMA-2024-11016","modified_time":"2024-12-09T06:50:04Z","versions":["0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.7","0.7.0","0.7.1"]},{"source":"ossf-package-analysis","sha256":"69c9f05e42e277434eb37e4dddb268f3144eb27cb1de261c86cd396f7b1c9d14","import_time":"2025-02-10T05:35:46.862635028Z","modified_time":"2024-09-28T16:06:10Z","versions":["0.5.6"]},{"source":"ossf-package-analysis","sha256":"69e5da8ec251eaf24472965979e51ce587019e7cde56a6ffd843c2387bedf8ce","import_time":"2025-02-10T05:35:47.085603349Z","modified_time":"2024-09-28T17:26:13Z","versions":["0.6.2"]},{"source":"ossf-package-analysis","sha256":"717efeef381f3586a0dd564a02156268a92ede80a1bc5cfe1edaba25483dd33f","import_time":"2025-02-10T05:35:47.001334878Z","modified_time":"2024-09-28T17:16:13Z","versions":["0.6.1"]},{"source":"ossf-package-analysis","sha256":"cd6f74fb7bf003f9463b7227a7f0ec3aa3886f74e8c1ff672b743a0cbaead2bd","import_time":"2025-02-10T05:35:46.93094204Z","modified_time":"2024-09-28T17:00:58Z","versions":["0.5.9"]},{"source":"ossf-package-analysis","sha256":"d7f15e3d41fac09e705cca6a4c954dd7cb326e99262f071cfe963fad67fef9f8","import_time":"2025-02-10T05:35:47.153358203Z","modified_time":"2024-09-28T17:31:07Z","versions":["0.6.5"]},{"source":"kam193","sha256":"ad05bc469f2afceb4046e1ab45b836e84a607b79bb0d8f10c520e21734340c23","import_time":"2025-12-02T22:30:55.966816082Z","id":"pypi/2024-09-pyprettifier/cryptograohy","modified_time":"2024-09-29T18:01:44Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"67095679f8af3205e005b17a996da2ba17789715d7c66e4fcf31d8c387b85c00","import_time":"2025-12-02T23:07:19.15733813Z","id":"pypi/2024-09-pyprettifier/cryptograohy","modified_time":"2024-09-29T18:01:44Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"277ab1c1f29ca50b242c7deed7e534c059ccce52681cb5278f02f68f9da64dfc","import_time":"2025-12-10T21:38:58.296627644Z","id":"pypi/2024-09-pyprettifier/cryptograohy","modified_time":"2024-09-29T18:01:44Z","versions":["0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.6","0.6.7","0.7.0","0.7.1"]}]}}