MAL-2024-12229

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/calculator-c08d6d50f5964131/MAL-2024-12229.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2024-12229
Published
2024-08-30T21:14:34Z
Modified
2025-12-12T20:32:47.240513Z
Summary
Malicious code in calculator-c08d6d50f5964131 (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (6343baa8b5e97a91b02979723f28035221550addc225d0e3911916a51ef5ef37)

Clearly research/pentesting examples containing reverse shell.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-examples-with-revshell

Reasons (based on the campaign):

  • dependency-confusion

  • The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "fe39991b437112af06f0775009986bf5833194a33941a4dd379605254739fe24",
            "source": "kam193",
            "modified_time": "2024-08-30T21:14:34Z",
            "id": "pypi/GENERIC-examples-with-revshell/calculator-c08d6d50f5964131",
            "ranges": [
                {
                    "type": "ECOSYSTEM",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "import_time": "2025-12-02T22:30:55.934121689Z"
        },
        {
            "sha256": "6343baa8b5e97a91b02979723f28035221550addc225d0e3911916a51ef5ef37",
            "source": "kam193",
            "modified_time": "2024-08-30T21:14:34Z",
            "id": "pypi/GENERIC-examples-with-revshell/calculator-c08d6d50f5964131",
            "ranges": [
                {
                    "type": "ECOSYSTEM",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "import_time": "2025-12-02T23:07:19.123440272Z"
        },
        {
            "sha256": "47df6dd48e50057ad0bd98ba7e2ba02535f84ac194171429fca42b0e3c4b85f4",
            "source": "kam193",
            "modified_time": "2024-08-30T21:14:34Z",
            "id": "pypi/GENERIC-examples-with-revshell/calculator-c08d6d50f5964131",
            "versions": [
                "1000.0.2"
            ],
            "import_time": "2025-12-10T21:38:58.258356274Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / calculator-c08d6d50f5964131

Package

Name
calculator-c08d6d50f5964131
View open source insights on deps.dev
Purl
pkg:pypi/calculator-c08d6d50f5964131

Affected ranges

Affected versions

1000.*
1000.0.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/calculator-c08d6d50f5964131/MAL-2024-12229.json"