{"id":"MAL-2026-2121","summary":"Malicious code in roboat (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (f04db4869c9e981873683b537f335c1f25c7c17c283315859699855a9c20816b)\nDuring installation, the code attempts to download and start malware.\n\nConnected with the campaign based on the time correlation and other packages published by the author.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-03-rowrap\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - malware\n","modified":"2026-03-24T20:32:01.427652Z","published":"2026-03-23T23:09:44Z","database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-03-rowrap/roboat","import_time":"2026-03-23T23:45:18.695034166Z","modified_time":"2026-03-23T23:09:44.958346Z","sha256":"f04db4869c9e981873683b537f335c1f25c7c17c283315859699855a9c20816b","source":"kam193","versions":["0.0.1","1.1.0","2.0.0","2.1.0"]},{"versions":["0.0.1","1.1.0","2.0.0","2.1.0","2.20"],"id":"pypi/2026-03-rowrap/roboat","import_time":"2026-03-24T20:16:47.766638462Z","modified_time":"2026-03-24T19:26:31.62413Z","sha256":"e94bd912e703150e428eafa84e1f5aea427c9afe6c30f16ff2b5aca6f52c55b1","source":"kam193"}],"iocs":{"domains":["dark-resonance-459b.blammervale.workers.dev","dry-hall-8967.blammervale.workers.dev"],"urls":["https://dark-resonance-459b.blammervale.workers.dev/555.bat","https://dry-hall-8967.blammervale.workers.dev/HHH.exe"]}},"references":[{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/7853783660953f032d117c78eb627fa7a22bdd828b161a58f2abc7405905bce2/detection"},{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/fa7d6114e0d7f164122f7080d19c83ffbfa8e2f3b56a9c7ba95bf5663f72b97c"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/roboat"}],"affected":[{"package":{"name":"roboat","ecosystem":"PyPI","purl":"pkg:pypi/roboat"},"versions":["0.0.1","1.1.0","2.0.0","2.1.0","2.20"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/roboat/MAL-2026-2121.json"}}],"schema_version":"1.7.5","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}