{"id":"MAL-2025-3462","summary":"Malicious code in quicolor (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (4b11a81f135d7d2ac414b7144af73523d15db7b0ce1a2757ba6ba95f50bf0be8)\nImporting the module starts a code that exfiltrates data from local Telegram application\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-03-quicolor\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-generic\n","modified":"2026-03-19T12:56:11.108339Z","published":"2025-03-25T09:28:59Z","database_specific":{"iocs":{"urls":["https://api.telegram.org/bot7866811532:AAHWBkH7NH7XheqQBRIdfoCk4psEr0BBrjg/sendDocument"]},"malicious-packages-origins":[{"import_time":"2025-04-25T09:36:47.756377711Z","modified_time":"2025-04-23T16:06:37Z","sha256":"6992e043da359299c0602007c4171c2812d8fb23710de6962240e111a677e7fe","source":"reversing-labs","versions":["9.7.3","9.8.1","10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.9"],"id":"RLMA-2025-02526"},{"ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}],"sha256":"672dc3cd0bf9a03396ecf3f2a881816efe7517f94912ccbf8aebda5579d66751","source":"kam193","id":"pypi/2025-03-quicolor/quicolor","import_time":"2025-12-02T22:30:55.515286515Z","modified_time":"2025-03-25T09:28:59Z"},{"id":"pypi/2025-03-quicolor/quicolor","import_time":"2025-12-02T23:07:18.54139259Z","modified_time":"2025-03-25T09:28:59Z","ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}],"sha256":"4b11a81f135d7d2ac414b7144af73523d15db7b0ce1a2757ba6ba95f50bf0be8","source":"kam193"},{"id":"pypi/2025-03-quicolor/quicolor","import_time":"2025-12-10T21:38:57.76072506Z","modified_time":"2025-03-25T09:28:59Z","sha256":"f942292de0d605b8134f722cc3b874a17340ae510ece7c2b942c6553ace9a4f8","source":"kam193","versions":["9.7.3","9.8.1","10.0.0","10.0.1","10.0.2","10.0.3","10.0.5","10.0.4","10.0.6","10.0.9"]},{"source":"kam193","versions":["9.7.3","9.8.1","10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.9"],"id":"pypi/2025-03-quicolor/quicolor","import_time":"2025-12-30T22:39:04.151988383Z","modified_time":"2025-03-25T09:28:59Z","sha256":"5eae13e9042ef97b67fd708be79993f965f6d7eab5ee2881784d05c68ef14aab"},{"id":"RLUA-2026-00680","import_time":"2026-03-19T12:20:19.821605919Z","modified_time":"2026-03-18T12:17:57Z","sha256":"fcc46d77ccf7d9617569b7c6468fcbb3aa8db7f7e112ed12bcf336937b94274c","source":"reversing-labs"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/quicolor"}],"affected":[{"package":{"name":"quicolor","ecosystem":"PyPI","purl":"pkg:pypi/quicolor"},"versions":["9.7.3","9.8.1","10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.9"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/quicolor/MAL-2025-3462.json"}}],"schema_version":"1.7.5","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}