pdatainstaller

{"modified":"2026-01-19T07:16:04Z","published":"2026-01-02T17:21:23Z","schema_version":"1.7.4","id":"MAL-2026-26","summary":"Malicious code in pdatainstaller (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (671a0098c14338197a26cb64b7f5c35c0e741f3151313fff784bc7a4862ad579)\nPackage is designed to download and execute a remote script, but the script itself seems to be broken (missing or wrong URLs). It's most probably a test before next packages with real malicious content.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-12-pdatainstaller\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - malware\n\n\n - Downloads and executes a remote executable.\n","affected":[{"package":{"ecosystem":"PyPI","name":"pdatainstaller"},"versions":["1.0.0"]}],"references":[{"type":"WEB","url":"https://www.virustotal.com/gui/file-analysis/NzcxYTcyZDQxMzc0ZDUwNTk4MDY4OTE3Y2U3MzdhNDY6MTc2NzQwMTQwOQ=="},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/pdatainstaller"}],"credits":[{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]}],"database_specific":{"iocs":{"urls":["https://pastebin.com/raw/s5WB7EtG","https://pastebin.com/raw/c3uYVYbT","https://github.com/uunnkknnoowwnn/dang/raw/refs/heads/main/svchost.exe"]},"malicious-packages-origins":[{"source":"kam193","sha256":"671a0098c14338197a26cb64b7f5c35c0e741f3151313fff784bc7a4862ad579","import_time":"2026-01-03T01:35:30.521984639Z","id":"pypi/2025-12-pdatainstaller/pdatainstaller","modified_time":"2026-01-02T17:21:23.366503Z","versions":["1.0.0"]},{"source":"kam193","sha256":"43639109001c8715b46aa2fad8a81b420f3d4b0d33f98429a4446a41071fff11","import_time":"2026-01-07T20:40:53.380621668Z","id":"pypi/2025-12-pdatainstaller/pdatainstaller","modified_time":"2026-01-02T17:21:23.366503Z","versions":["1.0.0"]},{"source":"kam193","sha256":"a0f61d7119c73856199e3d68b6a50685c53fbe27a1de18134f9e9d61e239e3cf","import_time":"2026-01-14T21:39:18.451950637Z","id":"pypi/2025-12-pdatainstaller/pdatainstaller","modified_time":"2026-01-02T17:21:23.366503Z","versions":["1.0.0"]},{"source":"kam193","sha256":"00ea1e05067a79da4cbe3d2d1a8a98e7599dc0ef49319046391ca397ceb4730e","import_time":"2026-01-19T07:14:29.762141154Z","id":"pypi/2025-12-pdatainstaller/pdatainstaller","modified_time":"2026-01-02T17:21:23.366503Z","versions":["1.0.0"]}]}}