{"id":"MAL-2025-41688","summary":"Malicious code in iamenumerate (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (d673b2612401a11ff219f59a9ca15986b4ce10d098f08d4beb5fbc9dc79ec554)\nThis one package is clearly created as part of the campaign, but the malicious code from the previous version has been removed (no other changes). It is anyway dangerous as most probably will be updated with the malicious code later\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-08-aws-enumerate\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-generic\n\n\n - action-hidden-in-lib-usage\n\n\n - exfiltration-credentials\n","modified":"2026-03-19T12:54:05.077506Z","published":"2025-08-14T23:01:46Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2025-08-28T07:11:11Z","sha256":"fc45e73b0a04b297209ed1bb954d79f1b6547c15b4c6a22391d2c516cf4fcf33","source":"reversing-labs","versions":["1.0.0"],"id":"RLMA-2025-04180","import_time":"2025-08-29T06:41:45.7241062Z"},{"import_time":"2025-09-26T11:06:10.151490423Z","modified_time":"2025-09-26T09:14:03Z","sha256":"b852c726e1c63be7486fee4fcd0a140260ab125b743c70f724b3e84e4f0a4798","source":"reversing-labs","versions":["1.0.1"],"id":"RLUA-2025-04775"},{"source":"kam193","versions":["1.0.0","1.0.1"],"id":"pypi/2025-08-aws-enumerate/iamenumerate","import_time":"2025-12-02T22:30:55.267906651Z","modified_time":"2025-08-25T07:46:08.612646Z","sha256":"f4f5b1e48d097fa6d8fcd93493dbf2d2c2c34ea4bcff0c2294a6488ed19da3aa"},{"source":"kam193","versions":["1.0.0","1.0.1"],"id":"pypi/2025-08-aws-enumerate/iamenumerate","import_time":"2025-12-02T23:07:18.292241226Z","modified_time":"2025-08-25T07:46:08.612646Z","sha256":"d673b2612401a11ff219f59a9ca15986b4ce10d098f08d4beb5fbc9dc79ec554"},{"id":"RLUA-2026-00418","import_time":"2026-03-19T12:19:54.356792477Z","modified_time":"2026-03-18T12:14:55Z","sha256":"73a324841548bbb575a481ab8259fdf3e6386cbf162c578370c912759c134f99","source":"reversing-labs"}],"iocs":{"domains":["api.aliyun-sdk-requests.xyz","aliyun-sdk-requests.xyz"],"urls":["https://api.aliyun-sdk-requests.xyz/aws","https://github.com/kohlersbtuh15/accesskey_tools"]}},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/iamenumerate"}],"affected":[{"package":{"name":"iamenumerate","ecosystem":"PyPI","purl":"pkg:pypi/iamenumerate"},"versions":["1.0.0","1.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/iamenumerate/MAL-2025-41688.json"}}],"schema_version":"1.7.5","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}