{"id":"MAL-2025-192438","summary":"Malicious code in synium (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (85fc917c33d970cb3365ff112f788b229638b757c32eaf99ba1054c8596298c1)\nDuring import, package exfiltrates specific global variables to a remote target in a way typical for infostealers\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-12-synium\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-credentials\n\n\n - exfiltration-generic\n","modified":"2025-12-31T02:55:01.263294Z","published":"2025-12-10T18:29:17Z","database_specific":{"iocs":{"urls":["https://t.me/+nnBhXKORtb8xYzNi"]},"malicious-packages-origins":[{"sha256":"85fc917c33d970cb3365ff112f788b229638b757c32eaf99ba1054c8596298c1","source":"kam193","versions":["1.0.2","1.0.1","1.0.0"],"id":"pypi/2025-12-synium/synium","import_time":"2025-12-10T19:36:28.621626956Z","modified_time":"2025-12-10T18:29:17.889655Z"},{"source":"kam193","versions":["1.0.0","1.0.1","1.0.2"],"id":"pypi/2025-12-synium/synium","import_time":"2025-12-30T22:39:04.189083647Z","modified_time":"2025-12-10T18:29:17.889655Z","sha256":"eb09648d942b8841b8a2258de694ebc78231e14635fe0c1cb17d88f7a1d14eb6"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/synium"}],"affected":[{"package":{"name":"synium","ecosystem":"PyPI","purl":"pkg:pypi/synium"},"versions":["1.0.2","1.0.1","1.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/synium/MAL-2025-192438.json"}}],"schema_version":"1.7.3","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}