Skip to content

Commit c4ce22f

Browse files
author
github-actions
committed
Ingest OSV - Cloud Storage
1 parent eb36eb5 commit c4ce22f

File tree

5 files changed

+295
-1
lines changed

5 files changed

+295
-1
lines changed

‎config/start-keys.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
amazon-inspector:
22
IN-MAL-: IN-MAL-2026-001146.json
33
kam193:
4-
pypi/packages/malicious/osv/: f385b4e03a38091523c41eca0e30b2ff3de36561
4+
pypi/packages/malicious/osv/: f2c16f106f5cc22c712b1cc33478c3f08b07b0b2
55
pypi/packages/pentest/osv/: 0d65fa30569acb74a4cd2f6968297f9cf794b510
66
pypi/packages/probably_pentest/osv/: dbfe89897c1972febd30846186aef4b82af004cd
77
ossf-package-analysis:

‎osv/malicious/pypi/logutilkit/MAL-0000-kam193-ac7ea80d57c3c34f.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"modified": "2026-03-23T22:53:57Z",
3+
"published": "2026-03-23T22:53:57Z",
4+
"schema_version": "1.7.4",
5+
"id": "",
6+
"summary": "Malicious code in logutilkit (PyPI)",
7+
"details": "Malicious clone of a legitimate package. When using it, the code attempts to download and execute remote code. In on of the incarnations, the malicious code was embeded in the strongly obfuscated file, which at least collected data from cryptowallets and password managers and exfiltrated them to a hardcoded remote location.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-03-license-utils-kit\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - obfuscation\n\n\n - crypto-related\n\n\n - action-hidden-in-lib-usage\n\n\n - exfiltration-credentials\n\n\n - clones-real-package\n\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "PyPI",
12+
"name": "logutilkit"
13+
},
14+
"versions": [
15+
"1.0.1"
16+
]
17+
}
18+
],
19+
"references": [
20+
{
21+
"type": "WEB",
22+
"url": "https://bad-packages.kam193.eu/pypi/package/logutilkit"
23+
}
24+
],
25+
"credits": [
26+
{
27+
"name": "Kamil Mańkowski (kam193)",
28+
"type": "REPORTER",
29+
"contact": [
30+
"https://github.com/kam193",
31+
"https://bad-packages.kam193.eu/"
32+
]
33+
}
34+
],
35+
"database_specific": {
36+
"iocs": {
37+
"domains": [
38+
"apachelicense.vercel.app"
39+
],
40+
"ips": [
41+
"66.45.225.94"
42+
]
43+
},
44+
"malicious-packages-origins": [
45+
{
46+
"source": "kam193",
47+
"sha256": "ac7ea80d57c3c34f71f9245d7c01172c9f5dfb7a757274b58253df1c3dff24e7",
48+
"import_time": "2026-03-23T23:45:18.693550378Z",
49+
"id": "pypi/2026-03-license-utils-kit/logutilkit",
50+
"modified_time": "2026-03-23T22:53:57.416367Z",
51+
"versions": [
52+
"1.0.1"
53+
]
54+
}
55+
]
56+
}
57+
}

‎osv/malicious/pypi/roboat/MAL-0000-kam193-f04db4869c9e9818.json‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
{
2+
"modified": "2026-03-23T23:09:44Z",
3+
"published": "2026-03-23T23:09:44Z",
4+
"schema_version": "1.7.4",
5+
"id": "",
6+
"summary": "Malicious code in roboat (PyPI)",
7+
"details": "During installation, the code attempts to download and start malware.\n\nConnected with the campaign based on the time correlation and other packages published by the author.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-03-rowrap\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - malware\n\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "PyPI",
12+
"name": "roboat"
13+
},
14+
"versions": [
15+
"0.0.1",
16+
"1.1.0",
17+
"2.0.0",
18+
"2.1.0"
19+
]
20+
}
21+
],
22+
"references": [
23+
{
24+
"type": "EVIDENCE",
25+
"url": "https://www.virustotal.com/gui/file/7853783660953f032d117c78eb627fa7a22bdd828b161a58f2abc7405905bce2/detection"
26+
},
27+
{
28+
"type": "EVIDENCE",
29+
"url": "https://www.virustotal.com/gui/file/fa7d6114e0d7f164122f7080d19c83ffbfa8e2f3b56a9c7ba95bf5663f72b97c"
30+
},
31+
{
32+
"type": "WEB",
33+
"url": "https://bad-packages.kam193.eu/pypi/package/roboat"
34+
}
35+
],
36+
"credits": [
37+
{
38+
"name": "Kamil Mańkowski (kam193)",
39+
"type": "REPORTER",
40+
"contact": [
41+
"https://github.com/kam193",
42+
"https://bad-packages.kam193.eu/"
43+
]
44+
}
45+
],
46+
"database_specific": {
47+
"iocs": {
48+
"domains": [
49+
"dark-resonance-459b.blammervale.workers.dev",
50+
"dry-hall-8967.blammervale.workers.dev"
51+
],
52+
"urls": [
53+
"https://dark-resonance-459b.blammervale.workers.dev/555.bat",
54+
"https://dry-hall-8967.blammervale.workers.dev/HHH.exe"
55+
]
56+
},
57+
"malicious-packages-origins": [
58+
{
59+
"source": "kam193",
60+
"sha256": "f04db4869c9e981873683b537f335c1f25c7c17c283315859699855a9c20816b",
61+
"import_time": "2026-03-23T23:45:18.695034166Z",
62+
"id": "pypi/2026-03-rowrap/roboat",
63+
"modified_time": "2026-03-23T23:09:44.958346Z",
64+
"versions": [
65+
"0.0.1",
66+
"1.1.0",
67+
"2.0.0",
68+
"2.1.0"
69+
]
70+
}
71+
]
72+
}
73+
}

‎osv/malicious/pypi/rowrap/MAL-0000-kam193-aa14a24775db29bd.json‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
{
2+
"modified": "2026-03-18T06:42:54Z",
3+
"published": "2026-03-18T06:42:54Z",
4+
"schema_version": "1.7.4",
5+
"id": "",
6+
"summary": "Malicious code in rowrap (PyPI)",
7+
"details": "The package hides code to download and start malicious script containing malware, identified as adware. The triggering method seems to be PTH file, although it's not always present\n\n Given the time correlation, it's likely armored continuation of 2026-03-robloxapi-testy\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-03-rowrap\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - malware\n\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "PyPI",
12+
"name": "rowrap"
13+
},
14+
"versions": [
15+
"1.0.0",
16+
"1.0.1",
17+
"1.0.2",
18+
"1.0.4",
19+
"1.0.8",
20+
"1.0.9",
21+
"1.1.0",
22+
"1.1.1",
23+
"1.1.2",
24+
"1.1.3",
25+
"1.1.5",
26+
"1.1.6",
27+
"1.1.8",
28+
"1.20",
29+
"1.21"
30+
]
31+
}
32+
],
33+
"references": [
34+
{
35+
"type": "EVIDENCE",
36+
"url": "https://www.virustotal.com/gui/file/7853783660953f032d117c78eb627fa7a22bdd828b161a58f2abc7405905bce2/detection"
37+
},
38+
{
39+
"type": "EVIDENCE",
40+
"url": "https://www.virustotal.com/gui/file/fa7d6114e0d7f164122f7080d19c83ffbfa8e2f3b56a9c7ba95bf5663f72b97c"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://bad-packages.kam193.eu/pypi/package/rowrap"
45+
}
46+
],
47+
"credits": [
48+
{
49+
"name": "Kamil Mańkowski (kam193)",
50+
"type": "REPORTER",
51+
"contact": [
52+
"https://github.com/kam193",
53+
"https://bad-packages.kam193.eu/"
54+
]
55+
}
56+
],
57+
"database_specific": {
58+
"iocs": {
59+
"domains": [
60+
"dark-resonance-459b.blammervale.workers.dev",
61+
"dry-hall-8967.blammervale.workers.dev"
62+
],
63+
"urls": [
64+
"https://dark-resonance-459b.blammervale.workers.dev/555.bat",
65+
"https://dry-hall-8967.blammervale.workers.dev/HHH.exe"
66+
]
67+
},
68+
"malicious-packages-origins": [
69+
{
70+
"source": "kam193",
71+
"sha256": "aa14a24775db29bdb8ff5f2e696e0499d404549e6e51f7b4b891973def89ce9f",
72+
"import_time": "2026-03-23T23:45:18.695924096Z",
73+
"id": "pypi/2026-03-rowrap/rowrap",
74+
"modified_time": "2026-03-18T06:42:54.318349Z",
75+
"versions": [
76+
"1.0.0",
77+
"1.0.1",
78+
"1.0.2",
79+
"1.0.4",
80+
"1.0.8",
81+
"1.0.9",
82+
"1.1.0",
83+
"1.1.1",
84+
"1.1.2",
85+
"1.1.3",
86+
"1.1.5",
87+
"1.1.6",
88+
"1.1.8",
89+
"1.20",
90+
"1.21"
91+
]
92+
}
93+
]
94+
}
95+
}

‎osv/malicious/pypi/rowrapee/MAL-0000-kam193-398cfbdac2d3602a.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"modified": "2026-03-23T23:17:18Z",
3+
"published": "2026-03-23T23:17:18Z",
4+
"schema_version": "1.7.4",
5+
"id": "",
6+
"summary": "Malicious code in rowrapee (PyPI)",
7+
"details": "The package hides code to download and start malicious script containing malware, identified as adware. The triggering method seems to be PTH file, although it's not always present\n\n Given the time correlation, it's likely armored continuation of 2026-03-robloxapi-testy\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-03-rowrap\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - malware\n\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "PyPI",
12+
"name": "rowrapee"
13+
},
14+
"versions": [
15+
"1.21",
16+
"1.22"
17+
]
18+
}
19+
],
20+
"references": [
21+
{
22+
"type": "EVIDENCE",
23+
"url": "https://www.virustotal.com/gui/file/7853783660953f032d117c78eb627fa7a22bdd828b161a58f2abc7405905bce2/detection"
24+
},
25+
{
26+
"type": "EVIDENCE",
27+
"url": "https://www.virustotal.com/gui/file/fa7d6114e0d7f164122f7080d19c83ffbfa8e2f3b56a9c7ba95bf5663f72b97c"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://bad-packages.kam193.eu/pypi/package/rowrapee"
32+
}
33+
],
34+
"credits": [
35+
{
36+
"name": "Kamil Mańkowski (kam193)",
37+
"type": "ANALYST",
38+
"contact": [
39+
"https://github.com/kam193",
40+
"https://bad-packages.kam193.eu/"
41+
]
42+
}
43+
],
44+
"database_specific": {
45+
"iocs": {
46+
"domains": [
47+
"dark-resonance-459b.blammervale.workers.dev",
48+
"dry-hall-8967.blammervale.workers.dev"
49+
],
50+
"urls": [
51+
"https://dark-resonance-459b.blammervale.workers.dev/555.bat",
52+
"https://dry-hall-8967.blammervale.workers.dev/HHH.exe"
53+
]
54+
},
55+
"malicious-packages-origins": [
56+
{
57+
"source": "kam193",
58+
"sha256": "398cfbdac2d3602a5c9836408942993c3f2bbcda911184825f01cf9937fb035e",
59+
"import_time": "2026-03-23T23:45:18.696556125Z",
60+
"id": "pypi/2026-03-rowrap/rowrapee",
61+
"modified_time": "2026-03-23T23:17:18.087654Z",
62+
"versions": [
63+
"1.21",
64+
"1.22"
65+
]
66+
}
67+
]
68+
}
69+
}

0 commit comments

Comments
 (0)