{"id":"MAL-2025-191803","summary":"Malicious code in network-utils-simple (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (1fd943d3243197ac153b2623548e62b4225a59f611cf13fe962bc3ced369a32d)\nDuring installation, there is an attempt to download and execute code. The package has no real functionality.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-02-network-utils-simple\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","modified":"2025-12-31T02:55:56.186940Z","published":"2025-02-14T23:02:49Z","database_specific":{"iocs":{"domains":["ip-database-netutils.pages.dev"]},"malicious-packages-origins":[{"id":"pypi/2025-02-network-utils-simple/network-utils-simple","import_time":"2025-12-02T22:30:55.358543894Z","modified_time":"2025-02-14T23:02:49Z","ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}],"sha256":"bc0c49092004be85dfeb1bde20187a0064ef40d2085df3aaf4fd5cf2e83c8a8f","source":"kam193"},{"modified_time":"2025-02-14T23:02:49Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"sha256":"1fd943d3243197ac153b2623548e62b4225a59f611cf13fe962bc3ced369a32d","source":"kam193","id":"pypi/2025-02-network-utils-simple/network-utils-simple","import_time":"2025-12-02T23:07:18.390595298Z"},{"sha256":"1771b174e3a524e62418469f2f9485ca3d5d0ccd7bfa76243a152d2c35fcec9d","source":"kam193","versions":["1.3.3","1.3.2","1.3.8","1.0.0","1.1.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.9","1.2.7","1.2.8","1.3.0","1.3.4","1.3.5","1.3.6","1.3.7"],"id":"pypi/2025-02-network-utils-simple/network-utils-simple","import_time":"2025-12-10T21:38:57.611129517Z","modified_time":"2025-02-14T23:02:49Z"},{"id":"pypi/2025-02-network-utils-simple/network-utils-simple","import_time":"2025-12-30T22:39:04.136110246Z","modified_time":"2025-02-14T23:02:49Z","sha256":"7f1712ca8ff4e22e19054082ecda7ef7b746121d7cb8662c1342d4804808dfb3","source":"kam193","versions":["1.0.0","1.1.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8"]}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/network-utils-simple"}],"affected":[{"package":{"name":"network-utils-simple","ecosystem":"PyPI","purl":"pkg:pypi/network-utils-simple"},"versions":["1.3.3","1.3.2","1.3.8","1.0.0","1.1.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.9","1.2.7","1.2.8","1.3.0","1.3.4","1.3.5","1.3.6","1.3.7"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/network-utils-simple/MAL-2025-191803.json"}}],"schema_version":"1.7.3","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"}]}