{"id":"MAL-2022-7421","summary":"Malicious code in ascii2text (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (f4a161cdfe88252de2eba4185ad1460062afc88659f928121253c995367ace33)\nSecurity researchers at Check Point Research discovered a malicious package called `ascii2text` impersonating the PyPI package `art`. PyPI has since removed `ascii2text`.\n","aliases":["GHSA-hqmv-64pp-q4xw"],"modified":"2023-11-08T04:20:11.996296Z","published":"2022-08-30T19:36:58Z","database_specific":{"malicious-packages-origins":[{"sha256":"f4a161cdfe88252de2eba4185ad1460062afc88659f928121253c995367ace33","source":"ghsa-malware","id":"GHSA-hqmv-64pp-q4xw","import_time":"2023-07-30T21:58:13.812005257Z","modified_time":"2022-08-30T19:36:58Z","ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}]}]},"references":[{"type":"WEB","url":"https://pypi.org/project/ascii2text/"},{"type":"WEB","url":"https://research.checkpoint.com/2022/cloudguard-spectral-detects-several-malicious-packages-on-pypi-the-official-software-repository-for-python-developers/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hqmv-64pp-q4xw"}],"affected":[{"package":{"name":"ascii2text","ecosystem":"PyPI","purl":"pkg:pypi/ascii2text"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ascii2text/MAL-2022-7421.json"}}],"schema_version":"1.7.3"}