do-not-install-this-package-001

{"modified":"2025-12-31T02:45:15Z","published":"2025-12-09T09:25:41Z","schema_version":"1.7.4","id":"MAL-2025-192387","summary":"Malicious code in do-not-install-this-package-001 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (27c17335ba5378258efc5d22274e8104e45a493eec51d60d0adbeb9c4f627714)\nGeneric campaign for all (likely) research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: GENERIC-questionable-pentest\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-env-variables\n\n\n - exfiltration-generic\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - typosquatting\n\n## Source: ossf-package-analysis (399ba544f533d013d73525a2e22fbc83c2f4f00ce44c27c15cff9ca8ccaf11de)\nThe OpenSSF Package Analysis project identified 'do-not-install-this-package-001' @ 0.1.3 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"ecosystem":"PyPI","name":"do-not-install-this-package-001"},"versions":["0.1.3","0.1.4","0.1.5","0.1.6"]}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/do-not-install-this-package-001"}],"credits":[{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"399ba544f533d013d73525a2e22fbc83c2f4f00ce44c27c15cff9ca8ccaf11de","import_time":"2025-12-09T09:39:48.707768508Z","modified_time":"2025-12-09T09:25:41Z","versions":["0.1.3"]},{"source":"ossf-package-analysis","sha256":"7249ad6aa9405dfaf9e7fad98da1c2cbc437ce5a803922315fc6d800e6e4283c","import_time":"2025-12-09T10:08:27.498058315Z","modified_time":"2025-12-09T09:45:48Z","versions":["0.1.4"]},{"source":"ossf-package-analysis","sha256":"2f9552a5ebf4c3459256111bab837a49dd05b9d3cf2dae2e7c02390a175ce1a6","import_time":"2025-12-09T11:06:32.658509704Z","modified_time":"2025-12-09T11:00:53Z","versions":["0.1.5"]},{"source":"kam193","sha256":"27c17335ba5378258efc5d22274e8104e45a493eec51d60d0adbeb9c4f627714","import_time":"2025-12-09T12:48:37.541206497Z","id":"pypi/GENERIC-questionable-pentest/do-not-install-this-package-001","modified_time":"2025-12-09T11:27:51.797776Z","versions":["0.1.5","0.1.4","0.1.3"]},{"source":"ossf-package-analysis","sha256":"9c0fe3a3376e6379d81ea6d55c068db9f72a785fc8123f35704e35efe5200b97","import_time":"2025-12-09T20:07:05.292640379Z","modified_time":"2025-12-09T20:06:00Z","versions":["0.1.6"]},{"source":"kam193","sha256":"020d2cade2c23bce047da08607f512130fc03ec69a70a79ec046a1d6a8f91d86","import_time":"2025-12-09T21:38:23.440762815Z","id":"pypi/GENERIC-questionable-pentest/do-not-install-this-package-001","modified_time":"2025-12-09T20:27:37.719212Z","versions":["0.1.5","0.1.4","0.1.3","0.1.6"]},{"source":"kam193","sha256":"ba206991cd762792a8755427477cd461efab8e1427e1cfabb02ddbdca15f7140","import_time":"2025-12-30T22:39:04.074694059Z","id":"pypi/GENERIC-questionable-pentest/do-not-install-this-package-001","modified_time":"2025-12-09T20:27:37.719212Z","versions":["0.1.3","0.1.4","0.1.5","0.1.6"]}]}}