{"id":"MAL-2025-2937","summary":"Malicious code in asyncaiosignal (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (8c9a16c81ad4cb5cef1907d6b9e4b5b352d53a6918e702610b428a455e799a2f)\nInfostealer with multiple possibilities, but not auto-activating on installation. There are already multiple attempts to publish it, with different innocent-looking names.\n\nThe campaign contains the with Infostealer itself and packages that include it as dependency and triggered.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-02-multis\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - The malicious code is intentionally included in a dependency of the package\n","modified":"2026-03-19T12:50:31.568779Z","published":"2025-02-13T13:18:05Z","database_specific":{"malicious-packages-origins":[{"id":"RLMA-2025-01935","import_time":"2025-03-31T07:07:04.61607754Z","modified_time":"2025-03-28T13:05:19Z","sha256":"8875ab520fc8d915df5e087e3a6fae32577d4f55fd29a4135b77385dee479803","source":"reversing-labs","versions":["0.3","0.4","0.5"]},{"sha256":"90c33ea036403342d65e0fa88616e1475f0b1d156f67adf68c2c852718f8b6a3","source":"reversing-labs","id":"RLUA-2025-03520","import_time":"2025-08-01T10:41:34.825020449Z","modified_time":"2025-07-31T19:13:59Z"},{"source":"kam193","id":"pypi/2025-02-multis/asyncaiosignal","import_time":"2025-12-02T22:30:54.949769987Z","modified_time":"2025-02-13T13:18:05Z","ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}],"sha256":"4764075428147bbedb89129b6391d245116558d32ce9034d18b6be25658b336f"},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"sha256":"8c9a16c81ad4cb5cef1907d6b9e4b5b352d53a6918e702610b428a455e799a2f","source":"kam193","id":"pypi/2025-02-multis/asyncaiosignal","import_time":"2025-12-02T23:07:17.989384729Z","modified_time":"2025-02-13T13:18:05Z"},{"source":"kam193","versions":["0.3","0.5","0.4"],"id":"pypi/2025-02-multis/asyncaiosignal","import_time":"2025-12-10T21:38:57.294963504Z","modified_time":"2025-02-13T13:18:05Z","sha256":"36ee57298770fd4e3082a3351d218982879ecc5b55de6c7f9c01c5a497716799"},{"id":"pypi/2025-02-multis/asyncaiosignal","import_time":"2025-12-30T22:39:04.041393501Z","modified_time":"2025-02-13T13:18:05Z","sha256":"166ec74bed9be4b56633666a729febe046b60bd4ea62392c1c86f54e1de1d00a","source":"kam193","versions":["0.3","0.4","0.5"]},{"sha256":"aefd3c2d8099c71184bfb10e638d91d3b7f31a20a2e5e1b8c37092b23e6119d5","source":"reversing-labs","id":"RLUA-2026-00087","import_time":"2026-03-19T12:19:24.261786618Z","modified_time":"2026-03-18T12:11:16Z"}]},"references":[{"type":"ARTICLE","url":"https://socket.dev/blog/2025-blockchain-and-cryptocurrency-threat-report"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/asyncaiosignal"}],"affected":[{"package":{"name":"asyncaiosignal","ecosystem":"PyPI","purl":"pkg:pypi/asyncaiosignal"},"versions":["0.3","0.4","0.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/asyncaiosignal/MAL-2025-2937.json"}}],"schema_version":"1.7.5","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}