bloxypy

{"modified":"2025-12-03T00:04:26Z","published":"2025-09-26T00:00:03Z","schema_version":"1.7.4","id":"MAL-2025-47572","summary":"Malicious code in bloxypy (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (ca1bb0aab09d6ef59ee1ff8485c8c2a6b565c1311246ed61d63c9757bd44ecdc)\nAttempting to use the module starts obfuscated code containing an infostealer\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-09-bloxypy\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - obfuscation\n\n\n - action-hidden-in-lib-usage\n\n\n - infostealer:kiwi\n\n\n - exfiltration-browser-data\n\n## Source: oracle-using-macaron (981253c2b6b99e04aff2ddfde86c215b40d6da1340c24fa8f2e2d0f7f797d82e)\nThis malicious package executes code obfuscated using Base64 encoding. It is designed to mimic the ro-py package.\n","affected":[{"package":{"ecosystem":"PyPI","name":"bloxypy","purl":"pkg:pypi/bloxypy"},"versions":["0.1.9"]}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/bloxypy"}],"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Oracle using Macaron","type":"FINDER","contact":["https://github.com/oracle/macaron"]}],"database_specific":{"iocs":{"urls":["https://discord.com/api/webhooks/1272911919686095030/YFEMYwnHMrm0g0TuWjMYY7eymWSr0Caq-npGXbI5dckduYI8EO7zjwdRq_47G0GP6K6l"]},"malicious-packages-origins":[{"source":"oracle-using-macaron","sha256":"981253c2b6b99e04aff2ddfde86c215b40d6da1340c24fa8f2e2d0f7f797d82e","import_time":"2025-09-26T00:00:03Z","modified_time":"2025-09-26T00:00:03Z","versions":["0.1.9"]},{"source":"kam193","sha256":"88482bd19a6d9cf3e08a5112b6b49b78870af1793b959d85f7bb2ee174def5bc","import_time":"2025-12-02T22:30:54.999587468Z","id":"pypi/2025-09-bloxypy/bloxypy","modified_time":"2025-09-26T10:13:12.359832Z","versions":["0.1.9"]},{"source":"kam193","sha256":"ca1bb0aab09d6ef59ee1ff8485c8c2a6b565c1311246ed61d63c9757bd44ecdc","import_time":"2025-12-02T23:07:18.028553766Z","id":"pypi/2025-09-bloxypy/bloxypy","modified_time":"2025-09-26T10:13:12.359832Z","versions":["0.1.9"]}]}}