{"id":"MAL-2026-26","summary":"Malicious code in pdatainstaller (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (671a0098c14338197a26cb64b7f5c35c0e741f3151313fff784bc7a4862ad579)\nPackage is designed to download and execute a remote script, but the script itself seems to be broken (missing or wrong URLs). It's most probably a test before next packages with real malicious content.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-12-pdatainstaller\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - malware\n\n\n - Downloads and executes a remote executable.\n","modified":"2026-02-23T02:57:26.816200Z","published":"2026-01-02T17:21:23Z","database_specific":{"iocs":{"urls":["https://pastebin.com/raw/s5WB7EtG","https://pastebin.com/raw/c3uYVYbT","https://github.com/uunnkknnoowwnn/dang/raw/refs/heads/main/svchost.exe"]},"malicious-packages-origins":[{"versions":["1.0.0"],"source":"kam193","id":"pypi/2025-12-pdatainstaller/pdatainstaller","modified_time":"2026-01-02T17:21:23.366503Z","import_time":"2026-01-03T01:35:30.521984639Z","sha256":"671a0098c14338197a26cb64b7f5c35c0e741f3151313fff784bc7a4862ad579"},{"versions":["1.0.0"],"source":"kam193","id":"pypi/2025-12-pdatainstaller/pdatainstaller","modified_time":"2026-01-02T17:21:23.366503Z","import_time":"2026-01-07T20:40:53.380621668Z","sha256":"43639109001c8715b46aa2fad8a81b420f3d4b0d33f98429a4446a41071fff11"},{"versions":["1.0.0"],"source":"kam193","id":"pypi/2025-12-pdatainstaller/pdatainstaller","modified_time":"2026-01-02T17:21:23.366503Z","import_time":"2026-01-14T21:39:18.451950637Z","sha256":"a0f61d7119c73856199e3d68b6a50685c53fbe27a1de18134f9e9d61e239e3cf"},{"versions":["1.0.0"],"source":"kam193","id":"pypi/2025-12-pdatainstaller/pdatainstaller","modified_time":"2026-01-02T17:21:23.366503Z","import_time":"2026-01-19T07:14:29.762141154Z","sha256":"00ea1e05067a79da4cbe3d2d1a8a98e7599dc0ef49319046391ca397ceb4730e"}]},"references":[{"type":"WEB","url":"https://www.virustotal.com/gui/file-analysis/NzcxYTcyZDQxMzc0ZDUwNTk4MDY4OTE3Y2U3MzdhNDY6MTc2NzQwMTQwOQ=="},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/pdatainstaller"}],"affected":[{"package":{"name":"pdatainstaller","ecosystem":"PyPI","purl":"pkg:pypi/pdatainstaller"},"versions":["1.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pdatainstaller/MAL-2026-26.json"}}],"schema_version":"1.7.3","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}