{"id":"MAL-2025-47572","summary":"Malicious code in bloxypy (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (ca1bb0aab09d6ef59ee1ff8485c8c2a6b565c1311246ed61d63c9757bd44ecdc)\nAttempting to use the module starts obfuscated code containing an infostealer\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-09-bloxypy\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - obfuscation\n\n\n - action-hidden-in-lib-usage\n\n\n - infostealer:kiwi\n\n\n - exfiltration-browser-data\n\n## Source: oracle-using-macaron (981253c2b6b99e04aff2ddfde86c215b40d6da1340c24fa8f2e2d0f7f797d82e)\nThis malicious package executes code obfuscated using Base64 encoding. It is designed to mimic the ro-py package.\n","modified":"2025-12-03T00:20:38.921659Z","published":"2025-09-26T00:00:03Z","database_specific":{"iocs":{"urls":["https://discord.com/api/webhooks/1272911919686095030/YFEMYwnHMrm0g0TuWjMYY7eymWSr0Caq-npGXbI5dckduYI8EO7zjwdRq_47G0GP6K6l"]},"malicious-packages-origins":[{"import_time":"2025-09-26T00:00:03Z","modified_time":"2025-09-26T00:00:03Z","sha256":"981253c2b6b99e04aff2ddfde86c215b40d6da1340c24fa8f2e2d0f7f797d82e","source":"oracle-using-macaron","versions":["0.1.9"]},{"id":"pypi/2025-09-bloxypy/bloxypy","import_time":"2025-12-02T22:30:54.999587468Z","modified_time":"2025-09-26T10:13:12.359832Z","sha256":"88482bd19a6d9cf3e08a5112b6b49b78870af1793b959d85f7bb2ee174def5bc","source":"kam193","versions":["0.1.9"]},{"import_time":"2025-12-02T23:07:18.028553766Z","modified_time":"2025-09-26T10:13:12.359832Z","sha256":"ca1bb0aab09d6ef59ee1ff8485c8c2a6b565c1311246ed61d63c9757bd44ecdc","source":"kam193","versions":["0.1.9"],"id":"pypi/2025-09-bloxypy/bloxypy"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/bloxypy"}],"affected":[{"package":{"name":"bloxypy","ecosystem":"PyPI","purl":"pkg:pypi/bloxypy"},"versions":["0.1.9"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/bloxypy/MAL-2025-47572.json"}}],"schema_version":"1.7.3","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"Oracle using Macaron","contact":["https://github.com/oracle/macaron"],"type":"FINDER"}]}