{"id":"MAL-2025-191771","summary":"Malicious code in jython-file (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (fc56f6ba4b75b25d4289c3aa3cb1d05f9b1d7bbfacf00b11e270d76ba87a1a3e)\nPackage attempts to load in an obfuscated way a code from a file (not included in the package) as well as inject a dynamic library to the Python dynamic libs directories.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-07-jython-file\n\n\nReasons (based on the campaign):\n\n\n - modify-system-without-consent\n\n\n - obfuscation\n","modified":"2025-12-12T20:38:08.713431Z","published":"2025-07-07T09:14:37Z","database_specific":{"malicious-packages-origins":[{"id":"pypi/2025-07-jython-file/jython-file","import_time":"2025-12-02T22:30:55.290668139Z","modified_time":"2025-07-07T09:14:37Z","ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}],"sha256":"8d77188ac0d4b558f8f4e150d8d2ad48b0014ee54dce2038c3805a6268cde605","source":"kam193"},{"import_time":"2025-12-02T23:07:18.315308155Z","modified_time":"2025-07-07T09:14:37Z","ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}],"sha256":"fc56f6ba4b75b25d4289c3aa3cb1d05f9b1d7bbfacf00b11e270d76ba87a1a3e","source":"kam193","id":"pypi/2025-07-jython-file/jython-file"},{"modified_time":"2025-07-07T09:14:37Z","sha256":"ee9867ffff34d570006ef0456a9108963b8ee67dc85559c72501474550f1622c","source":"kam193","versions":["0.999999999","0.9999999999","1.99999999999"],"id":"pypi/2025-07-jython-file/jython-file","import_time":"2025-12-10T21:38:57.560273908Z"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/jython-file"}],"affected":[{"package":{"name":"jython-file","ecosystem":"PyPI","purl":"pkg:pypi/jython-file"},"versions":["0.999999999","0.9999999999","1.99999999999"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/jython-file/MAL-2025-191771.json"}}],"schema_version":"1.7.3","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}