test-01-rafamarrara-learning-dc

{"schema_version":"1.7.4","id":"MAL-2026-18402","published":"2026-10-29T23:42:32Z","modified":"2026-10-30T12:43:49.639144584Z","summary":"Malicious code in test-01-rafamarrara-learning-dc (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (45afe749f07493f7ac02d61769393cb172f6eb98caf40462892f6dbc3c489612)\nPackage appears to be a learning/test artifact with no observable malicious behavior. No install-time or import-time network I/O, no credential or secret reads, no subprocess execution of fetched content, and no lifecycle hooks that would harm the installer.\n\n## Source: kam193 (c9be43a3b810f36aa360f4654e412805d5e5362b462836b38a161c99b6d07816)\nPackage offers a middleware adding allegedly diagnostic endpoint to a web app. Besides allowing for env variable exfiltration, it also contains a hidden functionality allowing executing sent commands.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-test-01-rafamarrara-learning-dc\n\n\nReasons (based on the campaign):\n\n\n - backdoor\n\n\n - exfiltration-env-variables\n","affected":[{"package":{"name":"test-01-rafamarrara-learning-dc","ecosystem":"PyPI"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"test_01_rafamarrara_learning_dc-1.0.0-py3-none-any.whl","hashes":{"blake2b_256":"f1c0bc9b95cb6075b856854e0ae38df318537de3c5e9bbecb81fdc0ad41349d1","md5":"53bf155cbc1f8a032c5e8964938b0819","sha256":"006681ecb1db11edd598f92d9d33dcc2cec7f97793a11ede1b67a27b575da137"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/test-01-rafamarrara-learning-dc"},{"type":"PACKAGE","url":"https://pypi.org/project/test-01-rafamarrara-learning-dc/1.0.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-test-01-rafamarrara-learning-dc/test-01-rafamarrara-learning-dc","import_time":"2026-10-30T00:35:16.841899395Z","modified_time":"2026-10-29T23:42:32.677875Z","sha256":"c9be43a3b810f36aa360f4654e412805d5e5362b462836b38a161c99b6d07816","source":"kam193","versions":["1.0.0"]},{"id":"IN-MAL-2026-022469","import_time":"2026-10-30T12:42:32.607630459Z","modified_time":"2026-10-30T12:34:12Z","sha256":"45afe749f07493f7ac02d61769393cb172f6eb98caf40462892f6dbc3c489612","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}