brummatts

{"schema_version":"1.7.4","id":"MAL-2026-18136","published":"2026-10-21T23:04:14Z","modified":"2026-10-29T14:38:27.536732684Z","summary":"Malicious code in brummatts (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (09b780cc0f3d918e82d8f9999cba10b7188b785d2c42a1a7bab2bc2f693e21c2)\nThe brummatts 0.1.0 PyPI package shows no code paths performing credential access, outbound network I/O to attacker-controlled destinations, install-time fetch-and-execute, silent relay of caller data, backdoor channels, or self-propagation. No lifecycle hooks or import-time side effects of concern were identified across the 13 files examined.\n\n## Source: kam193 (605ea05e6c6344e7ddfb713297d7689ee050288b74ecbf0821039603dc3cdd45)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - other\n","affected":[{"package":{"name":"brummatts","ecosystem":"PyPI"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"brummatts-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"d9782c693bd7f0747a19b6d53f6b909bbee316a02e5db0d325e9deeba6656dd5","md5":"d47b13e443abf54034732fd2f8a4cdcd","sha256":"3b124edac98d52874747ff7eae770666ca7ab30dd40f0a627d2caea5102a0327"}},{"filename":"brummatts-0.1.0.tar.gz","hashes":{"blake2b_256":"b85e2a03140661d7b0e98ade8fd1dcfeda01a523fcfd5034a52be64f7c7f10f8","md5":"87b2f3ea11c5037e366c9e7072e36fdc","sha256":"f6b4e7a30d658e531cb8ac01e7ef5ad307d19f7a1c5fce271db24a11f07e51f8"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/brummatts"},{"type":"PACKAGE","url":"https://pypi.org/project/brummatts/0.1.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/brummatts","import_time":"2026-10-21T23:40:12.28839671Z","modified_time":"2026-10-21T23:04:14.93441Z","sha256":"605ea05e6c6344e7ddfb713297d7689ee050288b74ecbf0821039603dc3cdd45","source":"kam193","versions":["0.1.0"]},{"id":"pypi/2026-10-voice-synthesis-profiles/brummatts","import_time":"2026-10-22T01:26:38.72105912Z","modified_time":"2026-10-21T23:04:14.93441Z","sha256":"3f8db224d6e3b0f2e94c2b84f1e4f85b54350f63839e4126145109f557068bb5","source":"kam193","versions":["0.1.0"]},{"id":"pypi/2026-10-voice-synthesis-profiles/brummatts","import_time":"2026-10-29T14:14:43.20778418Z","modified_time":"2026-10-21T23:04:14.93441Z","sha256":"dfa36cf70e465670b7a4dc2fba3a102e471b231620d4d3a2b5ada47e294db2b5","source":"kam193","versions":["0.1.0"]},{"id":"IN-MAL-2026-022366","import_time":"2026-10-29T14:37:05.94842037Z","modified_time":"2026-10-29T14:23:33Z","sha256":"09b780cc0f3d918e82d8f9999cba10b7188b785d2c42a1a7bab2bc2f693e21c2","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"}]}