{"id":"MAL-2025-5119","summary":"Malicious code in myownpyfiglet (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (feb59db3efc9397070b6fcdf08762e0defb77d34e5ababf463e3c1a7a1f5b927)\nMalicious clone of pyfiglet. Importing the package starts a series of downloading and executing of obfuscated malicious scripts, partially identified by AVs.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-05-rich-figlet\n\n\nReasons (based on the campaign):\n\n\n - backdoor\n\n\n - clones-real-package\n\n\n - obfuscation\n\n\n - Downloads and executes a remote malicious script.\n","modified":"2026-03-19T12:55:12.305768Z","published":"2025-05-15T21:07:23Z","database_specific":{"iocs":{"ips":["185.254.198.245"],"urls":["http://185.254.198.245:8080/update?token=4z1m6qbi4vzpwykp8YK4wAeZX89gbdwSy3dSCBGy2rkMjG5D0Alp5WO1RgktLeYk&platform=","http://185.254.198.245:80/admin/get.php","http://185.254.198.245:80/login/process.php"]},"malicious-packages-origins":[{"source":"reversing-labs","versions":["0.0.1"],"id":"RLMA-2025-03016","import_time":"2025-06-18T15:06:01.726420111Z","modified_time":"2025-06-18T10:15:14Z","sha256":"74a7f58af3314983edde6befa7ec2fb6fdab2337d0ac5f293c5156de6fc9da8f"},{"modified_time":"2025-05-15T21:07:23Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"sha256":"1222a5e7e6a1a7c9d034ec124fdf879e124d4a379cc981f33f2a501af0f7aaba","source":"kam193","id":"pypi/2025-05-rich-figlet/myownpyfiglet","import_time":"2025-12-02T22:30:55.353284163Z"},{"sha256":"feb59db3efc9397070b6fcdf08762e0defb77d34e5ababf463e3c1a7a1f5b927","source":"kam193","id":"pypi/2025-05-rich-figlet/myownpyfiglet","import_time":"2025-12-02T23:07:18.384501112Z","modified_time":"2025-05-15T21:07:23Z","ranges":[{"events":[{"introduced":"0"}],"type":"ECOSYSTEM"}]},{"sha256":"f7ad639a3307a53d4f88f630be9fc82a7b6e3f992d6bc47430a4f33ceef9c981","source":"kam193","versions":["0.0.1"],"id":"pypi/2025-05-rich-figlet/myownpyfiglet","import_time":"2025-12-10T21:38:57.607190144Z","modified_time":"2025-05-15T21:07:23Z"},{"source":"reversing-labs","id":"RLUA-2026-00548","import_time":"2026-03-19T12:20:07.703223495Z","modified_time":"2026-03-18T12:16:24Z","sha256":"1d91f1a21066383111eebb537d30059b74a0981314b5753ee5ce064a50c593f6"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/myownpyfiglet"}],"affected":[{"package":{"name":"myownpyfiglet","ecosystem":"PyPI","purl":"pkg:pypi/myownpyfiglet"},"versions":["0.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/myownpyfiglet/MAL-2025-5119.json"}}],"schema_version":"1.7.5","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}