MAL-2024-11660
See a problem?- Import Source
- https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pojang-resorter/MAL-2024-11660.json
- JSON Data
- https://api.osv.dev/v1/vulns/MAL-2024-11660
- Published
- 2024-09-02T20:50:31Z
- Modified
- 2026-03-19T12:55:19.852540Z
- Summary
- Malicious code in pojang-resorter (PyPI)
- Details
-
-= Per source details. Do not edit below this line.=-
Source: kam193 (2b5f9cd53d855ccc1ebed2b1f9dc610af8ee0978f5fa689cad954b3a56b1a22b)
Early versions used overriding install command to take screenshots, then it moved to automated installing an infostealer. Later the behaviour was changed and looks like being a toolkit to install malware, yet, depending on version, containing an automated infostealer installation. The exact code is partially hidden behind different obfuscation methods.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-08-pojang-resorter
Reasons (based on the campaign):
infostealer
The package overrides the install command in setup.py to execute malicious code during installation.
Downloads and executes a remote executable.
obfuscation
exfiltration-generic
- Database specific
{ "malicious-packages-origins": [ { "versions": [ "0.1", "0.2", "0.3", "0.4", "1.2", "1.6.2", "1.22", "1.25", "1.92", "1.97", "1.926", "1.9626", "2.3", "2.4", "2.32.7", "2.32.8", "2.32.9", "2.32.10", "2.32.14", "2.32.15", "2.32.16", "2.32.17", "2.32.18", "2.32.19", "2.32.20", "2.32.21", "2.32.22", "2.32.23", "2.32.24", "2.32.25", "2.32.26", "2.32.29", "2.32.30", "2.32.31", "2.32.33", "2.32.35", "2.33", "2.34", "5.5", "5.6", "5.6.1", "5.6.2", "5.6.3" ], "sha256": "32c46121ce286dd93e238b8c32109d1bd2b2db2d0c9625b54c58d7c9a83132f8", "modified_time": "2024-12-09T06:50:48Z", "source": "reversing-labs", "id": "RLMA-2024-11117", "import_time": "2024-12-09T14:38:46.993548396Z" }, { "sha256": "25a900f69627a1ddda55398fb22b00e30fe1a80967a07d0ef2ee48ee22e6e628", "ranges": [ { "events": [ { "introduced": "0" } ], "type": "ECOSYSTEM" } ], "modified_time": "2024-09-02T20:50:31Z", "source": "kam193", "id": "pypi/2024-08-pojang-resorter/pojang-resorter", "import_time": "2025-12-02T22:30:55.433338993Z" }, { "sha256": "2b5f9cd53d855ccc1ebed2b1f9dc610af8ee0978f5fa689cad954b3a56b1a22b", "ranges": [ { "events": [ { "introduced": "0" } ], "type": "ECOSYSTEM" } ], "modified_time": "2024-09-02T20:50:31Z", "source": "kam193", "id": "pypi/2024-08-pojang-resorter/pojang-resorter", "import_time": "2025-12-02T23:07:18.456595615Z" }, { "versions": [ "0.1", "0.2", "0.3", "0.4", "2.31", "2.32.26", "2.3", "1.97", "1.9626", "1.926", "1.92", "1.6.2", "1.25", "1.22", "1.2", "1.0", "0.7", "0.6", "0.5", "2.32.1", "2.32.2", "2.32.3", "2.32.5", "2.32.6", "2.32.7", "2.32.14", "2.32.8", "2.32.9", "2.32.10", "2.32.15", "2.32.11", "2.32.12", "2.32.13", "2.32.16", "2.32.23", "2.32.17", "2.32.18", "2.32.20", "2.32.19", "2.32.22", "2.32.30", "2.32.21", "2.32.24", "2.32.31", "2.32.25", "2.32.29", "5.5", "5.6.3", "2.32.33", "5.6", "2.32.35", "2.33", "2.34", "2.4", "5.6.1", "5.6.2" ], "sha256": "276307cb967db6b8578e23287085b8e186a88da47cdd7530cfa4bfb649e8a7c6", "modified_time": "2024-09-02T20:50:31Z", "source": "kam193", "id": "pypi/2024-08-pojang-resorter/pojang-resorter", "import_time": "2025-12-10T21:38:57.671697045Z" }, { "versions": [ "0.1", "0.2", "0.3", "0.4", "0.5", "0.6", "0.7", "1.0", "1.2", "1.6.2", "1.22", "1.25", "1.92", "1.97", "1.926", "1.9626", "2.3", "2.4", "2.31", "2.32.1", "2.32.2", "2.32.3", "2.32.5", "2.32.6", "2.32.7", "2.32.8", "2.32.9", "2.32.10", "2.32.11", "2.32.12", "2.32.13", "2.32.14", "2.32.15", "2.32.16", "2.32.17", "2.32.18", "2.32.19", "2.32.20", "2.32.21", "2.32.22", "2.32.23", "2.32.24", "2.32.25", "2.32.26", "2.32.29", "2.32.30", "2.32.31", "2.32.33", "2.32.35", "2.33", "2.34", "5.5", "5.6", "5.6.1", "5.6.2", "5.6.3" ], "sha256": "09781b6135eae3c4ff14430850b82116b9c2472214b517c98455d150ae52947d", "modified_time": "2024-09-02T20:50:31Z", "source": "kam193", "id": "pypi/2024-08-pojang-resorter/pojang-resorter", "import_time": "2025-12-30T22:39:04.139321565Z" }, { "sha256": "37bba5e5599491c09bfb3bed2f869a8aaf2d7da2bd1f75c897b028954b7b68ff", "modified_time": "2026-03-18T12:17:03Z", "source": "reversing-labs", "id": "RLUA-2026-00598", "import_time": "2026-03-19T12:20:12.775606065Z" } ] }- References
- Credits
-
-
- Kamil Mańkowski (kam193)
-
- Kamil Mańkowski (kam193) - REPORTER
-
- ReversingLabs - FINDER
-
Affected packages
PyPI / pojang-resorter
Package
- Name
- pojang-resorter
- View open source insights on deps.dev
- Purl
- pkg:pypi/pojang-resorter
Affected versions
0.*
0.1
0.2
0.3
0.4
0.5
0.6
0.7
1.*
1.0
1.2
1.6.2
1.22
1.25
1.92
1.97
1.926
1.9626
2.*
2.3
2.4
2.31
2.32.1
2.32.2
2.32.3
2.32.5
2.32.6
2.32.7
2.32.8
2.32.9
2.32.10
2.32.11
2.32.12
2.32.13
2.32.14
2.32.15
2.32.16
2.32.17
2.32.18
2.32.19
2.32.20
2.32.21
2.32.22
2.32.23
2.32.24
2.32.25
2.32.26
2.32.29
2.32.30
2.32.31
2.32.33
2.32.35
2.33
2.34
5.*
5.5
5.6
5.6.1
5.6.2
5.6.3