{"id":"MAL-2024-11568","summary":"Malicious code in cryptograohy (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (67095679f8af3205e005b17a996da2ba17789715d7c66e4fcf31d8c387b85c00)\nThe pyprettifier library has a feature to send out the user home path throuh the logger. It's attached to the __init__ of EmojiConverter class. Other related packages utilize a typosquatting to imitate real packages, and attempts to call the EmojiConverter from pyprettifier, triggering notifying the author about the user's home path.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: 2024-09-pyprettifier\n\n\nReasons (based on the campaign):\n\n\n - typosquatting\n\n\n - The malicious code is intentionally included in a dependency of the package\n\n\n - action-hidden-in-lib-usage\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n## Source: ossf-package-analysis (69c9f05e42e277434eb37e4dddb268f3144eb27cb1de261c86cd396f7b1c9d14)\nThe OpenSSF Package Analysis project identified 'cryptograohy' @ 0.5.6 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2025-12-12T20:38:52.123616Z","published":"2024-09-28T16:06:10Z","database_specific":{"malicious-packages-origins":[{"id":"RLMA-2024-11016","import_time":"2024-12-09T14:38:42.766062237Z","modified_time":"2024-12-09T06:50:04Z","sha256":"46fc867d84bea76cc43b2bc729531ba57bdfb586a25cbdff404caa24e3f0d674","source":"reversing-labs","versions":["0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.7","0.7.0","0.7.1"]},{"import_time":"2025-02-10T05:35:46.862635028Z","modified_time":"2024-09-28T16:06:10Z","sha256":"69c9f05e42e277434eb37e4dddb268f3144eb27cb1de261c86cd396f7b1c9d14","source":"ossf-package-analysis","versions":["0.5.6"]},{"source":"ossf-package-analysis","versions":["0.6.2"],"import_time":"2025-02-10T05:35:47.085603349Z","modified_time":"2024-09-28T17:26:13Z","sha256":"69e5da8ec251eaf24472965979e51ce587019e7cde56a6ffd843c2387bedf8ce"},{"modified_time":"2024-09-28T17:16:13Z","sha256":"717efeef381f3586a0dd564a02156268a92ede80a1bc5cfe1edaba25483dd33f","source":"ossf-package-analysis","versions":["0.6.1"],"import_time":"2025-02-10T05:35:47.001334878Z"},{"import_time":"2025-02-10T05:35:46.93094204Z","modified_time":"2024-09-28T17:00:58Z","sha256":"cd6f74fb7bf003f9463b7227a7f0ec3aa3886f74e8c1ff672b743a0cbaead2bd","source":"ossf-package-analysis","versions":["0.5.9"]},{"sha256":"d7f15e3d41fac09e705cca6a4c954dd7cb326e99262f071cfe963fad67fef9f8","source":"ossf-package-analysis","versions":["0.6.5"],"import_time":"2025-02-10T05:35:47.153358203Z","modified_time":"2024-09-28T17:31:07Z"},{"sha256":"ad05bc469f2afceb4046e1ab45b836e84a607b79bb0d8f10c520e21734340c23","source":"kam193","id":"pypi/2024-09-pyprettifier/cryptograohy","import_time":"2025-12-02T22:30:55.966816082Z","modified_time":"2024-09-29T18:01:44Z","ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}]},{"source":"kam193","id":"pypi/2024-09-pyprettifier/cryptograohy","import_time":"2025-12-02T23:07:19.15733813Z","modified_time":"2024-09-29T18:01:44Z","ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}],"sha256":"67095679f8af3205e005b17a996da2ba17789715d7c66e4fcf31d8c387b85c00"},{"id":"pypi/2024-09-pyprettifier/cryptograohy","import_time":"2025-12-10T21:38:58.296627644Z","modified_time":"2024-09-29T18:01:44Z","sha256":"277ab1c1f29ca50b242c7deed7e534c059ccce52681cb5278f02f68f9da64dfc","source":"kam193","versions":["0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.6","0.6.7","0.7.0","0.7.1"]}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/cryptograohy"}],"affected":[{"package":{"name":"cryptograohy","ecosystem":"PyPI","purl":"pkg:pypi/cryptograohy"},"versions":["0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.7","0.7.0","0.7.1","0.6.5","0.6.6"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/cryptograohy/MAL-2024-11568.json"}}],"schema_version":"1.7.3","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}