{"id":"MAL-2025-191644","summary":"Malicious code in lbank-connector-pythons (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (8e2d03134723d75ab2f0b36c6acad54fa5d16b4ba0f04bf2705e188fd19626b9)\nThis is a copy of a legit package with added basic exfiltration in the setup.py\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","modified":"2026-03-19T12:54:26.070205Z","published":"2025-10-22T12:45:32Z","database_specific":{"malicious-packages-origins":[{"id":"RLMA-2025-05615","import_time":"2025-12-02T09:09:38.069277714Z","modified_time":"2025-12-01T12:54:37Z","sha256":"be860829dcedc2bf0981c76c1ea75b885957e544a964d28cf69695e3ee2ac9ed","source":"reversing-labs","versions":["2.1","2.2","2.3"]},{"sha256":"a8ac8a9f87c9d93340528329867082207c0437ad9fe6d31408cf7754b5705ad9","source":"kam193","versions":["2.3","2.2","2.0"],"id":"pypi/GENERIC-standard-pypi-install-pentest/lbank-connector-pythons","import_time":"2025-12-02T22:30:56.166875864Z","modified_time":"2025-10-22T12:45:32.237742Z"},{"source":"kam193","versions":["2.3","2.2","2.0"],"id":"pypi/GENERIC-standard-pypi-install-pentest/lbank-connector-pythons","import_time":"2025-12-02T23:07:19.348565492Z","modified_time":"2025-10-22T12:45:32.237742Z","sha256":"8e2d03134723d75ab2f0b36c6acad54fa5d16b4ba0f04bf2705e188fd19626b9"},{"source":"kam193","versions":["2.0","2.2","2.3"],"id":"pypi/GENERIC-standard-pypi-install-pentest/lbank-connector-pythons","import_time":"2025-12-30T22:39:04.304135483Z","modified_time":"2025-10-22T12:45:32.237742Z","sha256":"50f436f344f514099ea2389611705259c9094e8f2f6a0faf819c43aa71987599"},{"id":"RLUA-2026-00466","import_time":"2026-03-19T12:19:59.123910507Z","modified_time":"2026-03-18T12:15:34Z","sha256":"4582809a7633a72953e4b02ed264609834dec8a8df6efab777fb50fc9d0db89e","source":"reversing-labs","versions":["2.0"]}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/lbank-connector-pythons"}],"affected":[{"package":{"name":"lbank-connector-pythons","ecosystem":"PyPI","purl":"pkg:pypi/lbank-connector-pythons"},"versions":["2.1","2.2","2.3","2.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/lbank-connector-pythons/MAL-2025-191644.json"}}],"schema_version":"1.7.5","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}