coloraiz

{"modified":"2026-03-19T12:23:25Z","published":"2025-05-16T10:10:16Z","schema_version":"1.7.4","id":"MAL-2025-5102","aliases":["SNYK-PYTHON-COLORAIZ-10305008"],"summary":"Malicious code in coloraiz (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (dc4606b3e3f05632a889906f4c259e329a08308382fbc27329752eb8ea6a6c3c)\nThe package imitates colorama, and places a proxy object over the original colorama module that on every usage executes a remote code. The remote script installs a backdoor through legitimate tunnelling software and upload access credentials to the attacker.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-05-coloraiz\n\n\nReasons (based on the campaign):\n\n\n - impersonation\n\n\n - clones-real-package\n\n\n - action-hidden-in-lib-usage\n\n\n - backdoor\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"ecosystem":"PyPI","name":"coloraiz","purl":"pkg:pypi/coloraiz"},"versions":["1.0.1","1.0.2","1.0.3"]}],"references":[{"type":"WEB","url":"https://checkmarx.com/zero-post/python-pypi-supply-chain-attack-colorama"},{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-PYTHON-COLORAIZ-10305008"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/coloraiz"}],"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"ReversingLabs","type":"FINDER","contact":["https://www.reversinglabs.com"]}],"database_specific":{"iocs":{"domains":["free.beeceptor.com"],"urls":["https://mp14dea413c69b2bf527.free.beeceptor.com/code"]},"malicious-packages-origins":[{"source":"reversing-labs","sha256":"9ea259f4f90a9ba1877acd31cdbe71bc8600e20a2cb9b83ba830cbac7df1ce4b","import_time":"2025-06-18T15:05:59.893976682Z","id":"RLMA-2025-02999","modified_time":"2025-06-18T10:15:04Z","versions":["1.0.1","1.0.2","1.0.3"]},{"source":"reversing-labs","sha256":"1a7ffe6fe6d8fd9746f01735fc68e8d4a9d8bd7ab89a54c16b6a7e1bebcf8b5e","import_time":"2025-08-01T10:41:34.878864893Z","id":"RLUA-2025-03566","modified_time":"2025-07-31T19:14:36Z"},{"source":"kam193","sha256":"6a81e133153e897e581658ea617c5256010587413cda88c2b6670c127291e39e","import_time":"2025-12-02T22:30:55.05547489Z","id":"pypi/2025-05-coloraiz/coloraiz","modified_time":"2025-05-16T10:10:16Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"dc4606b3e3f05632a889906f4c259e329a08308382fbc27329752eb8ea6a6c3c","import_time":"2025-12-02T23:07:18.065995073Z","id":"pypi/2025-05-coloraiz/coloraiz","modified_time":"2025-05-16T10:10:16Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"a9c7340f11b6c6b930c65d277226188952f3c0d49712726a4d9e78113ad152d4","import_time":"2025-12-10T21:38:57.357178826Z","id":"pypi/2025-05-coloraiz/coloraiz","modified_time":"2025-05-16T10:10:16Z","versions":["1.0.2","1.0.1","1.0.3"]},{"source":"kam193","sha256":"4f1b59ad5f047d550901ab3a30b5d6f663fea92b8ff764d6c327165b6a156363","import_time":"2025-12-30T22:39:04.055034198Z","id":"pypi/2025-05-coloraiz/coloraiz","modified_time":"2025-05-16T10:10:16Z","versions":["1.0.1","1.0.2","1.0.3"]},{"source":"reversing-labs","sha256":"1e4bed8653ea80abff62d06ad621c9ca63f0b99aab9110b98f2b1ae2c5b08ee0","import_time":"2026-03-19T12:19:34.637503163Z","id":"RLUA-2026-00207","modified_time":"2026-03-18T12:12:39Z"}]}}