zenomenallib

{"modified":"2026-03-19T12:23:26Z","published":"2025-09-09T21:22:39Z","schema_version":"1.7.4","id":"MAL-2025-47814","summary":"Malicious code in zenomenallib (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (4c6be0b94e3c9643885ae8893cd9523bd5ad735965a16a3df64a347bd38f8016)\nPackage is prepared to exfiltrate sensitive files. Different packages use different places for the malicious code: it runs during importing the module, is placed in a native binary, or in the setup.py script\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-08-xenlib\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n","affected":[{"package":{"ecosystem":"PyPI","name":"zenomenallib","purl":"pkg:pypi/zenomenallib"},"versions":["2.7.0"]}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/zenomenallib"}],"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","type":"ANALYST","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"ReversingLabs","type":"FINDER","contact":["https://www.reversinglabs.com"]}],"database_specific":{"iocs":{"domains":["xenx.lol"],"urls":["http://api.xenx.lol:14880/ssteal","http://api.xenx.lol:1337/check","http://apis.xenx.lol:1337/check"]},"malicious-packages-origins":[{"source":"reversing-labs","sha256":"aaf7926d44586ea02f00b2336539321cd4a1e5b42598161df6f1209baa693bf7","import_time":"2025-09-26T11:05:37.03511685Z","id":"RLMA-2025-04824","modified_time":"2025-09-26T09:14:53Z","versions":["2.7.0"]},{"source":"kam193","sha256":"3324eaf85f9368bc891dd089cd413ce957702dabc36c0dfc0c1280c384e3bc56","import_time":"2025-12-02T22:30:55.792365184Z","id":"pypi/2025-08-xenlib/zenomenallib","modified_time":"2025-09-09T21:22:39.655225Z","versions":["2.7.0"]},{"source":"kam193","sha256":"4c6be0b94e3c9643885ae8893cd9523bd5ad735965a16a3df64a347bd38f8016","import_time":"2025-12-02T23:07:18.836054707Z","id":"pypi/2025-08-xenlib/zenomenallib","modified_time":"2025-09-09T21:22:39.655225Z","versions":["2.7.0"]},{"source":"reversing-labs","sha256":"a684f623b574b542e54511cf3c3530dc551825eed72db6de1b1ea5584cb571e8","import_time":"2026-03-19T12:20:45.848641128Z","id":"RLUA-2026-00947","modified_time":"2026-03-18T12:21:14Z"}]}}