{"id":"MAL-2026-2124","summary":"Malicious code in mgrcfg (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (eeb9b6975940ff31a6a0f6361fd93d8d361a3687103c94c011a6fdf510a2fdec)\nThe code exfiltrates content copied to clipboard content to a hardcoded location. The code is obfuscated and has a persistence mechanism.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-03-cfgmgr-syn\n\n\nReasons (based on the campaign):\n\n\n - clipboard-stealing\n\n\n - obfuscation\n\n\n - exfiltration-generic\n\n\n - persistence\n","modified":"2026-03-24T06:01:59.638066Z","published":"2026-03-24T04:31:48Z","database_specific":{"malicious-packages-origins":[{"versions":["1.6.7","1.6.8","1.6.9"],"source":"kam193","sha256":"eeb9b6975940ff31a6a0f6361fd93d8d361a3687103c94c011a6fdf510a2fdec","import_time":"2026-03-24T05:08:17.94535229Z","modified_time":"2026-03-24T04:31:48.545801Z","id":"pypi/2026-03-cfgmgr-syn/mgrcfg"},{"versions":["1.6.7","1.6.8","1.6.9"],"source":"kam193","sha256":"891f9583196c3190b727faac5c6dd0e65d3977208147947e25836f3b6fc527d5","import_time":"2026-03-24T05:51:49.444021984Z","modified_time":"2026-03-24T04:31:48.545801Z","id":"pypi/2026-03-cfgmgr-syn/mgrcfg"}],"iocs":{"urls":["http://204.10.194.247:8765"],"ips":["204.10.194.247"]}},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/mgrcfg"}],"affected":[{"package":{"name":"mgrcfg","ecosystem":"PyPI","purl":"pkg:pypi/mgrcfg"},"versions":["1.6.7","1.6.8","1.6.9"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/mgrcfg/MAL-2026-2124.json"}}],"schema_version":"1.7.5","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}