{"id":"MAL-2024-9947","summary":"Malicious code in audio-separator-fork (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (c2fdb66a75c58bc11250d088e141d39a4d2bbf8be018db9bb0ca9fd219d7e257)\nClones real package and hoddens an obfuscated code trying to run remote scripts as well as establish backdoor through SSH.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2024-08-fireindahole.fun\n\n\nReasons (based on the campaign):\n\n\n - backdoor\n\n\n - action-hidden-in-lib-usage\n\n\n - clones-real-package\n\n\n - obfuscation\n\n\n - dependency-confusion\n","modified":"2026-03-19T12:50:51.772639Z","published":"2024-08-11T12:09:25Z","database_specific":{"iocs":{"domains":["fireindahole.fun"],"urls":["http://main.fireindahole.fun/script4separator.sh","http://main.fireindahole.fun/script3separator.sh","https://grabify.link/IFKU0H"]},"malicious-packages-origins":[{"source":"reversing-labs","import_time":"2024-10-24T00:56:53.709714178Z","sha256":"9de4b136e4620bf1f92f8a1d6b8fd206794988cc4137294a29829343d2e7ca1e","modified_time":"2024-10-16T14:36:36Z","id":"RLMA-2024-07843","versions":["0.8.10","0.8.11"]},{"source":"kam193","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"import_time":"2025-12-02T22:30:54.955947317Z","sha256":"e04cac0386c4b2e16da6fff25b508ffb8d2c9449217afcc577bb0e26180e8075","modified_time":"2024-08-11T12:09:25Z","id":"pypi/2024-08-fireindahole.fun/audio-separator-fork"},{"source":"kam193","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"import_time":"2025-12-02T23:07:17.996033016Z","sha256":"c2fdb66a75c58bc11250d088e141d39a4d2bbf8be018db9bb0ca9fd219d7e257","modified_time":"2024-08-11T12:09:25Z","id":"pypi/2024-08-fireindahole.fun/audio-separator-fork"},{"source":"kam193","import_time":"2025-12-10T21:38:57.300484676Z","sha256":"e8aca8b13425ef648df88ece52941fb4094e305036e6aaf95e46278d039e9163","modified_time":"2024-08-11T12:09:25Z","id":"pypi/2024-08-fireindahole.fun/audio-separator-fork","versions":["0.8.1","0.8.0","0.8.2","0.8.3","0.8.4","0.8.6","0.8.7","0.8.8","0.8.9","0.8.10","0.8.11"]},{"source":"kam193","import_time":"2025-12-30T22:39:04.042396361Z","sha256":"48edd97ea0faea28b66099d836ae41c3190e5c4fdc3493f0cf4f21d78c4a212e","modified_time":"2024-08-11T12:09:25Z","id":"pypi/2024-08-fireindahole.fun/audio-separator-fork","versions":["0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.6","0.8.7","0.8.8","0.8.9","0.8.10","0.8.11"]},{"source":"reversing-labs","import_time":"2026-03-19T12:19:27.495993687Z","sha256":"957b022c3a55add562d358b44a56b8e97a7bd413a303cc5c70d9a66ae2cdebb9","modified_time":"2026-03-18T12:11:37Z","id":"RLUA-2026-00119","versions":["0.8.0","0.8.2"]}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/audio-separator-fork"}],"affected":[{"package":{"name":"audio-separator-fork","ecosystem":"PyPI","purl":"pkg:pypi/audio-separator-fork"},"versions":["0.8.10","0.8.11","0.8.1","0.8.0","0.8.2","0.8.3","0.8.4","0.8.6","0.8.7","0.8.8","0.8.9"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/audio-separator-fork/MAL-2024-9947.json"}}],"schema_version":"1.7.5","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}