pojang-resorter

{"modified":"2026-03-19T12:23:25Z","published":"2024-09-02T20:50:31Z","schema_version":"1.7.4","id":"MAL-2024-11660","summary":"Malicious code in pojang-resorter (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (2b5f9cd53d855ccc1ebed2b1f9dc610af8ee0978f5fa689cad954b3a56b1a22b)\nEarly versions used overriding install command to take screenshots, then it moved to automated installing an infostealer. Later the behaviour was changed and looks like being a toolkit to install malware, yet, depending on version, containing an automated infostealer installation. The exact code is partially hidden behind different obfuscation methods.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2024-08-pojang-resorter\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - \n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - exfiltration-generic\n","affected":[{"package":{"ecosystem":"PyPI","name":"pojang-resorter","purl":"pkg:pypi/pojang-resorter"},"versions":["0.1","0.2","0.3","0.4","1.2","1.6.2","1.22","1.25","1.92","1.97","1.926","1.9626","2.3","2.4","2.32.7","2.32.8","2.32.9","2.32.10","2.32.14","2.32.15","2.32.16","2.32.17","2.32.18","2.32.19","2.32.20","2.32.21","2.32.22","2.32.23","2.32.24","2.32.25","2.32.26","2.32.29","2.32.30","2.32.31","2.32.33","2.32.35","2.33","2.34","5.5","5.6","5.6.1","5.6.2","5.6.3","2.31","1.0","0.7","0.6","0.5","2.32.1","2.32.2","2.32.3","2.32.5","2.32.6","2.32.11","2.32.12","2.32.13"]}],"references":[{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/3d30ffd98e870abc0e09fb3af94d65fc8efd391ede958dd0365007a7ae020ec0"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/pojang-resorter"}],"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"ReversingLabs","type":"FINDER","contact":["https://www.reversinglabs.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"reversing-labs","sha256":"32c46121ce286dd93e238b8c32109d1bd2b2db2d0c9625b54c58d7c9a83132f8","import_time":"2024-12-09T14:38:46.993548396Z","id":"RLMA-2024-11117","modified_time":"2024-12-09T06:50:48Z","versions":["0.1","0.2","0.3","0.4","1.2","1.6.2","1.22","1.25","1.92","1.97","1.926","1.9626","2.3","2.4","2.32.7","2.32.8","2.32.9","2.32.10","2.32.14","2.32.15","2.32.16","2.32.17","2.32.18","2.32.19","2.32.20","2.32.21","2.32.22","2.32.23","2.32.24","2.32.25","2.32.26","2.32.29","2.32.30","2.32.31","2.32.33","2.32.35","2.33","2.34","5.5","5.6","5.6.1","5.6.2","5.6.3"]},{"source":"kam193","sha256":"25a900f69627a1ddda55398fb22b00e30fe1a80967a07d0ef2ee48ee22e6e628","import_time":"2025-12-02T22:30:55.433338993Z","id":"pypi/2024-08-pojang-resorter/pojang-resorter","modified_time":"2024-09-02T20:50:31Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"2b5f9cd53d855ccc1ebed2b1f9dc610af8ee0978f5fa689cad954b3a56b1a22b","import_time":"2025-12-02T23:07:18.456595615Z","id":"pypi/2024-08-pojang-resorter/pojang-resorter","modified_time":"2024-09-02T20:50:31Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"276307cb967db6b8578e23287085b8e186a88da47cdd7530cfa4bfb649e8a7c6","import_time":"2025-12-10T21:38:57.671697045Z","id":"pypi/2024-08-pojang-resorter/pojang-resorter","modified_time":"2024-09-02T20:50:31Z","versions":["0.1","0.2","0.3","0.4","2.31","2.32.26","2.3","1.97","1.9626","1.926","1.92","1.6.2","1.25","1.22","1.2","1.0","0.7","0.6","0.5","2.32.1","2.32.2","2.32.3","2.32.5","2.32.6","2.32.7","2.32.14","2.32.8","2.32.9","2.32.10","2.32.15","2.32.11","2.32.12","2.32.13","2.32.16","2.32.23","2.32.17","2.32.18","2.32.20","2.32.19","2.32.22","2.32.30","2.32.21","2.32.24","2.32.31","2.32.25","2.32.29","5.5","5.6.3","2.32.33","5.6","2.32.35","2.33","2.34","2.4","5.6.1","5.6.2"]},{"source":"kam193","sha256":"09781b6135eae3c4ff14430850b82116b9c2472214b517c98455d150ae52947d","import_time":"2025-12-30T22:39:04.139321565Z","id":"pypi/2024-08-pojang-resorter/pojang-resorter","modified_time":"2024-09-02T20:50:31Z","versions":["0.1","0.2","0.3","0.4","0.5","0.6","0.7","1.0","1.2","1.6.2","1.22","1.25","1.92","1.97","1.926","1.9626","2.3","2.4","2.31","2.32.1","2.32.2","2.32.3","2.32.5","2.32.6","2.32.7","2.32.8","2.32.9","2.32.10","2.32.11","2.32.12","2.32.13","2.32.14","2.32.15","2.32.16","2.32.17","2.32.18","2.32.19","2.32.20","2.32.21","2.32.22","2.32.23","2.32.24","2.32.25","2.32.26","2.32.29","2.32.30","2.32.31","2.32.33","2.32.35","2.33","2.34","5.5","5.6","5.6.1","5.6.2","5.6.3"]},{"source":"reversing-labs","sha256":"37bba5e5599491c09bfb3bed2f869a8aaf2d7da2bd1f75c897b028954b7b68ff","import_time":"2026-03-19T12:20:12.775606065Z","id":"RLUA-2026-00598","modified_time":"2026-03-18T12:17:03Z"}]}}