{"id":"MAL-2025-191689","summary":"Malicious code in backtradingbot (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (117c24f5b7a0f5e4921e4478231a717ecca01748a5b266d8984e619f06173984)\nRunning the installed entry point downloads and executes remote code. During the analysis, the code was switching to websockets, adding a startup script and downloading next stages, which finally looked for browser and crypto wallet data. Currently, they seem not to attempt exfiltration of very sensitive data but rather a presence of different webbrowsers and wallets.\n\nIt uses the same remote domain as campaign 2025-07-db-indicator, but significantly different payload.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-07-backtradingbot\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - peristence-autorun\n\n\n - exfiltration-browser-data\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - crypto-related\n","modified":"2025-12-31T02:52:30.867971Z","published":"2025-07-31T08:37:38Z","database_specific":{"iocs":{"domains":["etherjs.pro"],"urls":["https://api.etherjs.pro/sockets?type=2","https://api.etherjs.pro/sockets?type=2&cid=ft"]},"malicious-packages-origins":[{"import_time":"2025-12-02T22:30:54.966139974Z","modified_time":"2025-07-31T08:37:38.895634Z","ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}],"sha256":"e6ba5a032a0d73af329025dde0405bd7f1847f95e6cc19af6a7fb1c448874738","source":"kam193","id":"pypi/2025-07-backtradingbot/backtradingbot"},{"modified_time":"2025-07-31T08:37:38.895634Z","ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}],"sha256":"117c24f5b7a0f5e4921e4478231a717ecca01748a5b266d8984e619f06173984","source":"kam193","id":"pypi/2025-07-backtradingbot/backtradingbot","import_time":"2025-12-02T23:07:18.003966867Z"},{"versions":["0.1.2","0.1.1","0.1.3","0.1.4","0.1.5"],"id":"pypi/2025-07-backtradingbot/backtradingbot","import_time":"2025-12-10T21:38:57.305501438Z","modified_time":"2025-07-31T08:37:38.895634Z","sha256":"ce3087733438f472d2652f1c18c089932f54dbe353e966b440fe57c30f6a7c75","source":"kam193"},{"source":"kam193","versions":["0.1.1","0.1.2","0.1.3","0.1.4","0.1.5"],"id":"pypi/2025-07-backtradingbot/backtradingbot","import_time":"2025-12-30T22:39:04.046648871Z","modified_time":"2025-07-31T08:37:38.895634Z","sha256":"5d66cb7e375b65f749267ca86c38fc16c318851ec20c7cfdf351f98339720fc5"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/campaign/2025-07-db-indicator/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/backtradingbot"}],"affected":[{"package":{"name":"backtradingbot","ecosystem":"PyPI","purl":"pkg:pypi/backtradingbot"},"versions":["0.1.2","0.1.1","0.1.3","0.1.4","0.1.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/backtradingbot/MAL-2025-191689.json"}}],"schema_version":"1.7.3","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}