MAL-2024-9067

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/website-scanner/MAL-2024-9067.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2024-9067
Published
2024-10-01T14:51:20Z
Modified
2025-12-12T20:41:17.340383Z
Summary
Malicious code in website-scanner (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (bab4a414e51f614858ff935138ccb2632b0ba1801566c398a699e692715ccaae)

The obfuscated code in setup.py on installation collects information about the system (all possible about hardware, available resources, IP, names, etc.) and sends to a telegram webhook.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2024-09-website-scanner

Reasons (based on the campaign):

  • exfiltration-generic

  • obfuscation

  • A Telegram webhook is used to send collected data.

Source: ossf-package-analysis (06dde0f250e5ce430d8501b6cecadc7839daed79bdaf46415c8c59f53114fab8)

The OpenSSF Package Analysis project identified 'website-scanner' @ 1.0.0 (pypi) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "iocs": {
        "urls": [
            "https://api.telegram.org/bot7140748891:AAER8n1iFArAAMlK1dUdPeAs6sRi8vK6QgU/sendMessage"
        ]
    },
    "malicious-packages-origins": [
        {
            "sha256": "06dde0f250e5ce430d8501b6cecadc7839daed79bdaf46415c8c59f53114fab8",
            "source": "ossf-package-analysis",
            "import_time": "2024-10-02T03:37:58.047877956Z",
            "versions": [
                "1.0.0"
            ],
            "modified_time": "2024-10-01T14:51:20Z"
        },
        {
            "sha256": "677d8b34d6f083d27ddd6ae3a324aaa6e084f543c1b33c0871abf7b26e571ea9",
            "source": "kam193",
            "import_time": "2025-12-02T22:30:55.762733437Z",
            "modified_time": "2024-10-01T15:49:45Z",
            "id": "pypi/2024-09-website-scanner/website-scanner",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "ECOSYSTEM"
                }
            ]
        },
        {
            "sha256": "bab4a414e51f614858ff935138ccb2632b0ba1801566c398a699e692715ccaae",
            "source": "kam193",
            "import_time": "2025-12-02T23:07:18.805239139Z",
            "modified_time": "2024-10-01T15:49:45Z",
            "id": "pypi/2024-09-website-scanner/website-scanner",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "ECOSYSTEM"
                }
            ]
        },
        {
            "sha256": "e040b4a75acca156955b5da79b3df464c665bc86727fd87d0e0ee675e96ecc6f",
            "source": "kam193",
            "import_time": "2025-12-10T21:38:57.970967946Z",
            "versions": [
                "1.0.0"
            ],
            "id": "pypi/2024-09-website-scanner/website-scanner",
            "modified_time": "2024-10-01T15:49:45Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / website-scanner

Package

Name
website-scanner
View open source insights on deps.dev
Purl
pkg:pypi/website-scanner

Affected ranges

Affected versions

1.*

1.0.0