{"id":"MAL-2025-191876","summary":"Malicious code in speedd-testing-bot (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (2aaec37a58d7717b510aa569770af696e33ae7f9a59e733af3d6341d712f0d66)\nThe package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-10-speedd-testing-bot\n\n\nReasons (based on the campaign):\n\n\n - rat\n\n\n - Downloads and executes a remote malicious script.\n\n\n - typosquatting\n","modified":"2026-07-20T06:32:29.809376018Z","published":"2025-10-28T19:23:53Z","database_specific":{"malicious-packages-origins":[{"source":"kam193","sha256":"8b4d3ec5703e4b8137b2a14ba931c94f6fa99282a52b0e084f23774d8f9527c8","import_time":"2025-12-02T22:30:55.604171226Z","id":"pypi/2025-10-speedd-testing-bot/speedd-testing-bot","modified_time":"2025-10-28T19:23:53.795242Z","versions":["0.2"]},{"import_time":"2025-12-02T23:07:18.643616658Z","id":"pypi/2025-10-speedd-testing-bot/speedd-testing-bot","modified_time":"2025-10-28T19:23:53.795242Z","versions":["0.2"],"source":"kam193","sha256":"b2c8226bceca5e4ecb7950563c129411c4541487f265f417a358bb42170357dd"},{"import_time":"2025-12-31T15:38:00.896361455Z","id":"pypi/2025-10-speedd-testing-bot/speedd-testing-bot","modified_time":"2025-10-28T19:23:53.795242Z","versions":["0.2"],"source":"kam193","sha256":"2aaec37a58d7717b510aa569770af696e33ae7f9a59e733af3d6341d712f0d66"},{"versions":["0.2"],"source":"kam193","sha256":"1329244d3e5dfdef07b3cc834eeb8bcf8765f76ac8351b1af6350bfe293be678","import_time":"2026-01-12T23:35:38.666193357Z","id":"pypi/2025-10-speedd-testing-bot/speedd-testing-bot","modified_time":"2025-10-28T19:23:53.795242Z"},{"modified_time":"2025-10-28T19:23:53.795242Z","versions":["0.2"],"source":"kam193","sha256":"e50af7aaba81cf32521bbe78eabde8e358e8721b0a599287f6bf4a32c50b6545","import_time":"2026-01-18T23:07:34.015994405Z","id":"pypi/2025-10-speedd-testing-bot/speedd-testing-bot"},{"source":"kam193","sha256":"476a2ea3c5babf4b9efb0534f42f9ccf56287a8db0eceb2674abd6eaa929e060","import_time":"2026-02-26T09:49:02.340316385Z","id":"pypi/2025-10-speedd-testing-bot/speedd-testing-bot","modified_time":"2025-10-28T19:23:53.795242Z","versions":["0.2"]},{"versions":["0.2"],"source":"kam193","sha256":"70e4b10aa6299c8adfd97edc3045fe8eec81f3230bbf0574f49492194fb74914","import_time":"2026-07-20T06:05:22.563899401Z","id":"pypi/2025-10-speedd-testing-bot/speedd-testing-bot","modified_time":"2025-10-28T19:23:53.795242Z"}],"iocs":{"domains":["server-unlock-hack.onrender.com"],"urls":["https://pastebin.com/raw/xAT1vudj"]}},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/speedd-testing-bot"},{"type":"WEB","url":"https://www.getsafety.com/blog-posts/telegrem-bot-malware"}],"affected":[{"package":{"name":"speedd-testing-bot","ecosystem":"PyPI","purl":"pkg:pypi/speedd-testing-bot"},"versions":["0.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/speedd-testing-bot/MAL-2025-191876.json"}}],"schema_version":"1.7.5","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}