scrambleeeer

{"schema_version":"1.7.4","id":"MAL-2026-14358","published":"2026-08-22T09:47:41Z","modified":"2026-08-23T03:27:45.449982834Z","summary":"Malicious code in scrambleeeer (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2a65599e4b6ca9e8349fbde07e578e53844af217c6eca15dcd6bb99c8a1fa63f)\nPackage advertises a trivial string-shuffle utility, but its exported function scrambleeeer() opens a TCP socket to bax.h4x.tv:6363, duplicates stdin/stdout/stderr onto that socket, and spawns /bin/bash via pty.spawn. Any caller who invokes the documented API hands an interactive bash shell on the installer's host to whoever controls bax.h4x.tv:6363. The destination is hardcoded, not user-configurable, undocumented, and unrelated to the package's stated purpose.\n\n## Source: kam193 (52bcde495e195edfc164c36aa7f704643c3171eaffc477c28de4b60c7dd2d414)\nWhen using the provided library, the code starts a reverse shell to a hardcoded location.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-scrambleeer\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.\n\n\n - action-hidden-in-lib-usage\n","affected":[{"package":{"name":"scrambleeeer","ecosystem":"PyPI"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/scrambleeeer/core.py","sha256":"efc920f084c206d0a7262d0c81e2f8d2aabc27b79b4e392c8aa644042559e04f","tlsh":"6501b85bfe13348d77f54dbe60e86012616e1d837778042838684bac2f2365cb9f0b09"}],"package_integrity":[{"filename":"scrambleeeer-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"0b689ccc2f8d23e43177e1f1507c7483f438b741dd0ce5004afa4e5b7d5c7c78","md5":"9c5272374dfcac3f6613a83608d25396","sha256":"a1602827bf78d7799675029c4de0c2152a8354594fbab1f4903bba62c06be609"}},{"filename":"scrambleeeer-0.1.0.tar.gz","hashes":{"blake2b_256":"030efc5c7fda14c12821552de028cc40335fe11843d9aa24f1f92deac230d098","md5":"46c5538a37fafbb76233b714c3a85b4f","sha256":"c3df3db21d35fa2498e555722d36431538250b83da2ed0cc51df458ceb10e700"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/scrambleeeer"},{"type":"PACKAGE","url":"https://pypi.org/project/scrambleeeer/0.1.0/"}],"database_specific":{"iocs":{"domains":["bax.h4x.tv"]},"malicious-packages-origins":[{"id":"pypi/2026-08-scrambleeer/scrambleeeer","import_time":"2026-08-22T10:09:30.010126707Z","modified_time":"2026-08-22T09:47:41.162896Z","sha256":"52bcde495e195edfc164c36aa7f704643c3171eaffc477c28de4b60c7dd2d414","source":"kam193","versions":["0.1.0"]},{"id":"IN-MAL-2026-018513","import_time":"2026-08-23T03:25:50.79440662Z","modified_time":"2026-08-23T02:57:10Z","sha256":"2a65599e4b6ca9e8349fbde07e578e53844af217c6eca15dcd6bb99c8a1fa63f","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}