grokwrapper

{"modified":"2026-02-26T09:50:46Z","published":"2026-02-08T10:34:16Z","schema_version":"1.7.4","id":"MAL-2026-811","summary":"Malicious code in grokwrapper (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (a7ae896464be7f195243e35231a2435d0a1eb055cc7fa8cfaef707c7e11c55b2)\nDuring importing the module, package silently execute code hidden in an embedded config file, and downloads remote executable. It's then added to Run registry key for persistence and started.\n\nDuring analysis, the executable was not detected by antiviruses.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-02-grokwrapper\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - peristence-autorun\n","affected":[{"package":{"ecosystem":"PyPI","name":"grokwrapper"},"versions":["0.1.0","0.2.0"]}],"references":[{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/1963f8777e33d95c106ba28857058348eed021b4b86c46bad63b63dabada26ce/summary"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/grokwrapper"},{"type":"WEB","url":"https://www.getsafety.com/blog-posts/grokwrapper"}],"credits":[{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]}],"database_specific":{"iocs":{"urls":["https://dl.dropboxusercontent.com/scl/fi/su8ks7znqh6lzkd9n26yt/PenisKOZLA.gif?rlkey=6otsosk8q7bjv2z44i16bmblo&st=ehtbhkv8&dl=1"]},"malicious-packages-origins":[{"source":"kam193","sha256":"a7ae896464be7f195243e35231a2435d0a1eb055cc7fa8cfaef707c7e11c55b2","import_time":"2026-02-08T10:44:49.658863606Z","id":"pypi/2026-02-grokwrapper/grokwrapper","modified_time":"2026-02-08T10:34:16.102765Z","versions":["0.1.0","0.2.0"]},{"source":"kam193","sha256":"6a020c1f62988aa0b040fe97d8a8444b8e38e3a8cdd62197795d96fdd8a0c8b3","import_time":"2026-02-26T09:49:02.311151596Z","id":"pypi/2026-02-grokwrapper/grokwrapper","modified_time":"2026-02-08T10:34:16.102765Z","versions":["0.1.0","0.2.0"]}]}}