{"id":"MAL-2024-11620","summary":"Malicious code in kekiktaban (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (80c5f1e8e195c782d87e63c2bfc7eac3febe17836c3d502594ea10524f97464e)\nObfuscated package containing multiple techniques detecting sandboxing and exfiltrating basic data to a telegram webhook, with a little other functionality\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2024-10-kekiktaban\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - A Telegram webhook is used to send collected data.\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n","modified":"2026-03-19T12:54:22.953019Z","published":"2024-10-27T10:04:32Z","database_specific":{"iocs":{"urls":["https://gist.github.com/keyiflerolsun/5127472bed55917e8945bf8699cc844a"]},"malicious-packages-origins":[{"source":"reversing-labs","versions":["0.6.0"],"id":"RLMA-2024-11074","import_time":"2024-12-09T14:38:44.993411721Z","modified_time":"2024-12-09T06:50:29Z","sha256":"a37bcce0d9ab3462cb9c6a28502e3bb93a8d962c025f61354cb6caf714e5404e"},{"import_time":"2025-12-02T22:30:55.295745678Z","modified_time":"2024-10-27T10:04:32Z","ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}],"sha256":"1f376baeef8d4c70a3037abe44232c5e21add2b2b81ada605a3f93cb7774dfc7","source":"kam193","id":"pypi/2024-10-kekiktaban/kekiktaban"},{"id":"pypi/2024-10-kekiktaban/kekiktaban","import_time":"2025-12-02T23:07:18.320899778Z","modified_time":"2024-10-27T10:04:32Z","ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}],"sha256":"80c5f1e8e195c782d87e63c2bfc7eac3febe17836c3d502594ea10524f97464e","source":"kam193"},{"import_time":"2025-12-10T21:38:57.561211906Z","modified_time":"2024-10-27T10:04:32Z","sha256":"e7cf8f4c9db7b6a01e4a65f98098f446ba407745192919c788ce5f0e38fd37a9","source":"kam193","versions":["0.5.0","0.6.0"],"id":"pypi/2024-10-kekiktaban/kekiktaban"},{"modified_time":"2026-03-18T12:15:21Z","sha256":"e1457355e77eb976c19f65b03947dc428ffac01ff49042f3baa6f8e0af007ec8","source":"reversing-labs","id":"RLUA-2026-00450","import_time":"2026-03-19T12:19:57.291494422Z"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/kekiktaban"}],"affected":[{"package":{"name":"kekiktaban","ecosystem":"PyPI","purl":"pkg:pypi/kekiktaban"},"versions":["0.6.0","0.5.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/kekiktaban/MAL-2024-11620.json"}}],"schema_version":"1.7.5","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}