audio-separator-fork

{"modified":"2026-03-19T12:23:25Z","published":"2024-08-11T12:09:25Z","schema_version":"1.7.4","id":"MAL-2024-9947","summary":"Malicious code in audio-separator-fork (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (c2fdb66a75c58bc11250d088e141d39a4d2bbf8be018db9bb0ca9fd219d7e257)\nClones real package and hoddens an obfuscated code trying to run remote scripts as well as establish backdoor through SSH.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2024-08-fireindahole.fun\n\n\nReasons (based on the campaign):\n\n\n - backdoor\n\n\n - action-hidden-in-lib-usage\n\n\n - clones-real-package\n\n\n - obfuscation\n\n\n - dependency-confusion\n","affected":[{"package":{"ecosystem":"PyPI","name":"audio-separator-fork","purl":"pkg:pypi/audio-separator-fork"},"versions":["0.8.10","0.8.11","0.8.1","0.8.0","0.8.2","0.8.3","0.8.4","0.8.6","0.8.7","0.8.8","0.8.9"]}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/audio-separator-fork"}],"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"ReversingLabs","type":"FINDER","contact":["https://www.reversinglabs.com"]}],"database_specific":{"iocs":{"domains":["fireindahole.fun"],"urls":["http://main.fireindahole.fun/script4separator.sh","http://main.fireindahole.fun/script3separator.sh","https://grabify.link/IFKU0H"]},"malicious-packages-origins":[{"source":"reversing-labs","sha256":"9de4b136e4620bf1f92f8a1d6b8fd206794988cc4137294a29829343d2e7ca1e","import_time":"2024-10-24T00:56:53.709714178Z","id":"RLMA-2024-07843","modified_time":"2024-10-16T14:36:36Z","versions":["0.8.10","0.8.11"]},{"source":"kam193","sha256":"e04cac0386c4b2e16da6fff25b508ffb8d2c9449217afcc577bb0e26180e8075","import_time":"2025-12-02T22:30:54.955947317Z","id":"pypi/2024-08-fireindahole.fun/audio-separator-fork","modified_time":"2024-08-11T12:09:25Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"c2fdb66a75c58bc11250d088e141d39a4d2bbf8be018db9bb0ca9fd219d7e257","import_time":"2025-12-02T23:07:17.996033016Z","id":"pypi/2024-08-fireindahole.fun/audio-separator-fork","modified_time":"2024-08-11T12:09:25Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"e8aca8b13425ef648df88ece52941fb4094e305036e6aaf95e46278d039e9163","import_time":"2025-12-10T21:38:57.300484676Z","id":"pypi/2024-08-fireindahole.fun/audio-separator-fork","modified_time":"2024-08-11T12:09:25Z","versions":["0.8.1","0.8.0","0.8.2","0.8.3","0.8.4","0.8.6","0.8.7","0.8.8","0.8.9","0.8.10","0.8.11"]},{"source":"kam193","sha256":"48edd97ea0faea28b66099d836ae41c3190e5c4fdc3493f0cf4f21d78c4a212e","import_time":"2025-12-30T22:39:04.042396361Z","id":"pypi/2024-08-fireindahole.fun/audio-separator-fork","modified_time":"2024-08-11T12:09:25Z","versions":["0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.6","0.8.7","0.8.8","0.8.9","0.8.10","0.8.11"]},{"source":"reversing-labs","sha256":"957b022c3a55add562d358b44a56b8e97a7bd413a303cc5c70d9a66ae2cdebb9","import_time":"2026-03-19T12:19:27.495993687Z","id":"RLUA-2026-00119","modified_time":"2026-03-18T12:11:37Z","versions":["0.8.0","0.8.2"]}]}}