quicolor

{"modified":"2026-03-19T12:23:26Z","published":"2025-03-25T09:28:59Z","schema_version":"1.7.4","id":"MAL-2025-3462","summary":"Malicious code in quicolor (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (4b11a81f135d7d2ac414b7144af73523d15db7b0ce1a2757ba6ba95f50bf0be8)\nImporting the module starts a code that exfiltrates data from local Telegram application\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-03-quicolor\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-generic\n","affected":[{"package":{"ecosystem":"PyPI","name":"quicolor","purl":"pkg:pypi/quicolor"},"versions":["9.7.3","9.8.1","10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.9"]}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/quicolor"}],"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","type":"ANALYST","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"ReversingLabs","type":"FINDER","contact":["https://www.reversinglabs.com"]}],"database_specific":{"iocs":{"urls":["https://api.telegram.org/bot7866811532:AAHWBkH7NH7XheqQBRIdfoCk4psEr0BBrjg/sendDocument"]},"malicious-packages-origins":[{"source":"reversing-labs","sha256":"6992e043da359299c0602007c4171c2812d8fb23710de6962240e111a677e7fe","import_time":"2025-04-25T09:36:47.756377711Z","id":"RLMA-2025-02526","modified_time":"2025-04-23T16:06:37Z","versions":["9.7.3","9.8.1","10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.9"]},{"source":"kam193","sha256":"672dc3cd0bf9a03396ecf3f2a881816efe7517f94912ccbf8aebda5579d66751","import_time":"2025-12-02T22:30:55.515286515Z","id":"pypi/2025-03-quicolor/quicolor","modified_time":"2025-03-25T09:28:59Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"4b11a81f135d7d2ac414b7144af73523d15db7b0ce1a2757ba6ba95f50bf0be8","import_time":"2025-12-02T23:07:18.54139259Z","id":"pypi/2025-03-quicolor/quicolor","modified_time":"2025-03-25T09:28:59Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"f942292de0d605b8134f722cc3b874a17340ae510ece7c2b942c6553ace9a4f8","import_time":"2025-12-10T21:38:57.76072506Z","id":"pypi/2025-03-quicolor/quicolor","modified_time":"2025-03-25T09:28:59Z","versions":["9.7.3","9.8.1","10.0.0","10.0.1","10.0.2","10.0.3","10.0.5","10.0.4","10.0.6","10.0.9"]},{"source":"kam193","sha256":"5eae13e9042ef97b67fd708be79993f965f6d7eab5ee2881784d05c68ef14aab","import_time":"2025-12-30T22:39:04.151988383Z","id":"pypi/2025-03-quicolor/quicolor","modified_time":"2025-03-25T09:28:59Z","versions":["9.7.3","9.8.1","10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.9"]},{"source":"reversing-labs","sha256":"fcc46d77ccf7d9617569b7c6468fcbb3aa8db7f7e112ed12bcf336937b94274c","import_time":"2026-03-19T12:20:19.821605919Z","id":"RLUA-2026-00680","modified_time":"2026-03-18T12:17:57Z"}]}}