{"id":"MAL-2025-41699","summary":"Malicious code in m5tlprovetomegz (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (41041b6e55e23e7b8d40be5bb95a75fdba5b64cb9524c86054deabcd2177e459)\nImporting the module starts downloading and executing a file recognized as malicious by AVs\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-07-m5tlprovetomegz\n\n\nReasons (based on the campaign):\n\n\n - malware\n\n\n - Downloads and executes a remote executable.\n","modified":"2026-03-19T12:54:32.005824Z","published":"2025-07-24T23:11:21Z","database_specific":{"iocs":{"urls":["https://github.com/GrayHATGroupx69/Simple-Obsfacture/raw/refs/heads/main/x695test.exe"]},"malicious-packages-origins":[{"sha256":"0d9b7dc8331eb2997090234ca73a4aa5d69579bc6ac6bcd3f4621a80afc68377","source":"reversing-labs","versions":["0.1.0","0.1.1"],"id":"RLMA-2025-04193","import_time":"2025-08-29T06:41:47.059689055Z","modified_time":"2025-08-28T07:11:20Z"},{"ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}],"sha256":"687b85e4f704918e8e36ad13bfeba2bed752cfca080c5467343c7e35da45fded","source":"kam193","id":"pypi/2025-07-m5tlprovetomegz/m5tlprovetomegz","import_time":"2025-12-02T22:30:55.320476291Z","modified_time":"2025-07-24T23:11:21.747742Z"},{"id":"pypi/2025-07-m5tlprovetomegz/m5tlprovetomegz","import_time":"2025-12-02T23:07:18.347712907Z","modified_time":"2025-07-24T23:11:21.747742Z","ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}],"sha256":"41041b6e55e23e7b8d40be5bb95a75fdba5b64cb9524c86054deabcd2177e459","source":"kam193"},{"id":"pypi/2025-07-m5tlprovetomegz/m5tlprovetomegz","import_time":"2025-12-10T21:38:57.580788048Z","modified_time":"2025-07-24T23:11:21.747742Z","sha256":"e89a518d28a92f592fdc055887892c42b310aa627ecf14f0370b0f2bd4844d26","source":"kam193","versions":["0.1.0","0.1.1"]},{"id":"RLUA-2026-00485","import_time":"2026-03-19T12:20:00.717553368Z","modified_time":"2026-03-18T12:15:45Z","sha256":"285b3e80ec0896f9baaa87380294109a6781eab577204546cdb812441ffdec35","source":"reversing-labs"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/m5tlprovetomegz"}],"affected":[{"package":{"name":"m5tlprovetomegz","ecosystem":"PyPI","purl":"pkg:pypi/m5tlprovetomegz"},"versions":["0.1.0","0.1.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/m5tlprovetomegz/MAL-2025-41699.json"}}],"schema_version":"1.7.5","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}