backtradingbot

{"modified":"2025-12-31T02:45:15Z","published":"2025-07-31T08:37:38Z","schema_version":"1.7.4","id":"MAL-2025-191689","summary":"Malicious code in backtradingbot (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (117c24f5b7a0f5e4921e4478231a717ecca01748a5b266d8984e619f06173984)\nRunning the installed entry point downloads and executes remote code. During the analysis, the code was switching to websockets, adding a startup script and downloading next stages, which finally looked for browser and crypto wallet data. Currently, they seem not to attempt exfiltration of very sensitive data but rather a presence of different webbrowsers and wallets.\n\nIt uses the same remote domain as campaign 2025-07-db-indicator, but significantly different payload.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-07-backtradingbot\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - peristence-autorun\n\n\n - exfiltration-browser-data\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - crypto-related\n","affected":[{"package":{"ecosystem":"PyPI","name":"backtradingbot"},"versions":["0.1.2","0.1.1","0.1.3","0.1.4","0.1.5"]}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/campaign/2025-07-db-indicator/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/backtradingbot"}],"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]}],"database_specific":{"iocs":{"domains":["etherjs.pro"],"urls":["https://api.etherjs.pro/sockets?type=2","https://api.etherjs.pro/sockets?type=2&cid=ft"]},"malicious-packages-origins":[{"source":"kam193","sha256":"e6ba5a032a0d73af329025dde0405bd7f1847f95e6cc19af6a7fb1c448874738","import_time":"2025-12-02T22:30:54.966139974Z","id":"pypi/2025-07-backtradingbot/backtradingbot","modified_time":"2025-07-31T08:37:38.895634Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"117c24f5b7a0f5e4921e4478231a717ecca01748a5b266d8984e619f06173984","import_time":"2025-12-02T23:07:18.003966867Z","id":"pypi/2025-07-backtradingbot/backtradingbot","modified_time":"2025-07-31T08:37:38.895634Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"ce3087733438f472d2652f1c18c089932f54dbe353e966b440fe57c30f6a7c75","import_time":"2025-12-10T21:38:57.305501438Z","id":"pypi/2025-07-backtradingbot/backtradingbot","modified_time":"2025-07-31T08:37:38.895634Z","versions":["0.1.2","0.1.1","0.1.3","0.1.4","0.1.5"]},{"source":"kam193","sha256":"5d66cb7e375b65f749267ca86c38fc16c318851ec20c7cfdf351f98339720fc5","import_time":"2025-12-30T22:39:04.046648871Z","id":"pypi/2025-07-backtradingbot/backtradingbot","modified_time":"2025-07-31T08:37:38.895634Z","versions":["0.1.1","0.1.2","0.1.3","0.1.4","0.1.5"]}]}}