{"id":"MAL-2025-192387","summary":"Malicious code in do-not-install-this-package-001 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (27c17335ba5378258efc5d22274e8104e45a493eec51d60d0adbeb9c4f627714)\nGeneric campaign for all (likely) research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: GENERIC-questionable-pentest\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-env-variables\n\n\n - exfiltration-generic\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - typosquatting\n\n## Source: ossf-package-analysis (399ba544f533d013d73525a2e22fbc83c2f4f00ce44c27c15cff9ca8ccaf11de)\nThe OpenSSF Package Analysis project identified 'do-not-install-this-package-001' @ 0.1.3 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2025-12-31T02:53:23.436634Z","published":"2025-12-09T09:25:41Z","database_specific":{"malicious-packages-origins":[{"import_time":"2025-12-09T09:39:48.707768508Z","modified_time":"2025-12-09T09:25:41Z","sha256":"399ba544f533d013d73525a2e22fbc83c2f4f00ce44c27c15cff9ca8ccaf11de","source":"ossf-package-analysis","versions":["0.1.3"]},{"import_time":"2025-12-09T10:08:27.498058315Z","modified_time":"2025-12-09T09:45:48Z","sha256":"7249ad6aa9405dfaf9e7fad98da1c2cbc437ce5a803922315fc6d800e6e4283c","source":"ossf-package-analysis","versions":["0.1.4"]},{"import_time":"2025-12-09T11:06:32.658509704Z","modified_time":"2025-12-09T11:00:53Z","sha256":"2f9552a5ebf4c3459256111bab837a49dd05b9d3cf2dae2e7c02390a175ce1a6","source":"ossf-package-analysis","versions":["0.1.5"]},{"modified_time":"2025-12-09T11:27:51.797776Z","sha256":"27c17335ba5378258efc5d22274e8104e45a493eec51d60d0adbeb9c4f627714","source":"kam193","versions":["0.1.5","0.1.4","0.1.3"],"id":"pypi/GENERIC-questionable-pentest/do-not-install-this-package-001","import_time":"2025-12-09T12:48:37.541206497Z"},{"import_time":"2025-12-09T20:07:05.292640379Z","modified_time":"2025-12-09T20:06:00Z","sha256":"9c0fe3a3376e6379d81ea6d55c068db9f72a785fc8123f35704e35efe5200b97","source":"ossf-package-analysis","versions":["0.1.6"]},{"sha256":"020d2cade2c23bce047da08607f512130fc03ec69a70a79ec046a1d6a8f91d86","source":"kam193","versions":["0.1.5","0.1.4","0.1.3","0.1.6"],"id":"pypi/GENERIC-questionable-pentest/do-not-install-this-package-001","import_time":"2025-12-09T21:38:23.440762815Z","modified_time":"2025-12-09T20:27:37.719212Z"},{"import_time":"2025-12-30T22:39:04.074694059Z","modified_time":"2025-12-09T20:27:37.719212Z","sha256":"ba206991cd762792a8755427477cd461efab8e1427e1cfabb02ddbdca15f7140","source":"kam193","versions":["0.1.3","0.1.4","0.1.5","0.1.6"],"id":"pypi/GENERIC-questionable-pentest/do-not-install-this-package-001"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/do-not-install-this-package-001"}],"affected":[{"package":{"name":"do-not-install-this-package-001","ecosystem":"PyPI","purl":"pkg:pypi/do-not-install-this-package-001"},"versions":["0.1.3","0.1.4","0.1.5","0.1.6"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/do-not-install-this-package-001/MAL-2025-192387.json"}}],"schema_version":"1.7.3","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}