scraper-npm

{"modified":"2026-02-23T09:51:45Z","published":"2026-02-23T08:59:49Z","schema_version":"1.7.4","id":"MAL-2026-1000","summary":"Malicious code in scraper-npm (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (5705e85e8288aeffbfe964329624dcbb5b2e30cebb0023da5b605ee5fb0aef4e)\nDuring import, the package exfiltrates files (especially .env and JSON) and eventually configures a backdoor by adding its own SSH key to the authorized_keys.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-02-scraper-npm\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - backdoor\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n","affected":[{"package":{"ecosystem":"PyPI","name":"scraper-npm"},"versions":["1.0.4"]}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/scraper-npm"}],"credits":[{"name":"Kamil Mańkowski (kam193)","type":"ANALYST","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]}],"database_specific":{"iocs":{"domains":["api.bensaru.site","bensaru.site"],"urls":["https://api.bensaru.site/api/validate/files"]},"malicious-packages-origins":[{"source":"kam193","sha256":"5705e85e8288aeffbfe964329624dcbb5b2e30cebb0023da5b605ee5fb0aef4e","import_time":"2026-02-23T09:23:51.901509003Z","id":"pypi/2026-02-scraper-npm/scraper-npm","modified_time":"2026-02-23T08:59:49.553899Z","versions":["1.0.4"]},{"source":"kam193","sha256":"d7f20e2472b63356859f93d837362f5473465c3bfe950dc41183d41aa2790d67","import_time":"2026-02-23T09:49:38.141206339Z","id":"pypi/2026-02-scraper-npm/scraper-npm","modified_time":"2026-02-23T08:59:49.553899Z","versions":["1.0.4"]}]}}