MAL-2025-191616

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/aiohappyeyeball/MAL-2025-191616.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-191616
Published
2025-10-27T13:53:33Z
Modified
2026-03-19T12:49:55.899995Z
Summary
Malicious code in aiohappyeyeball (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (c4026e5d61b51d8fb2688488995ad95c662a15084e5c4799b0e68d0962291056)

Malicious copy of the legit aiohappyeyeballs package, the pycache/staggerd.pyc contains a suspicious binary content (which seems not to be a valid PYC)

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-10-asynhttp

Reasons (based on the campaign):

  • typosquatting

  • exfiltration-generic

  • obfuscation

  • clones-real-package

  • native-extension

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "2.6.1"
            ],
            "sha256": "c2eaa21adf5623d3117f788f57020f42fbec6493a7cd96130f6b5a22afd90976",
            "modified_time": "2025-12-01T12:54:01Z",
            "source": "reversing-labs",
            "id": "RLMA-2025-05583",
            "import_time": "2025-12-02T09:09:35.816511014Z"
        },
        {
            "versions": [
                "2.6.1"
            ],
            "sha256": "419e887ea734cca886f42852f3fb9c909c929a28e2b5ac2c0e336d0cabea5624",
            "modified_time": "2025-10-27T13:53:33.468102Z",
            "source": "kam193",
            "id": "pypi/2025-10-asynhttp/aiohappyeyeball",
            "import_time": "2025-12-02T22:30:54.889031179Z"
        },
        {
            "versions": [
                "2.6.1"
            ],
            "sha256": "b39e28cdffb4bcc78f050861bc6c2b3d30b6c71996f87a4759b49e5f77b2d2fe",
            "modified_time": "2025-10-27T13:53:33.468102Z",
            "source": "kam193",
            "id": "pypi/2025-10-asynhttp/aiohappyeyeball",
            "import_time": "2025-12-02T23:07:17.932721433Z"
        },
        {
            "versions": [
                "2.6.1"
            ],
            "sha256": "c4026e5d61b51d8fb2688488995ad95c662a15084e5c4799b0e68d0962291056",
            "modified_time": "2025-10-27T13:53:33.468102Z",
            "source": "kam193",
            "id": "pypi/2025-10-asynhttp/aiohappyeyeball",
            "import_time": "2025-12-10T18:45:05.202780298Z"
        },
        {
            "sha256": "4b1f0143fe6c7e24e0b3ddb4783d05395c2049b5e8e5357a45de4e1f04593158",
            "modified_time": "2026-03-18T12:10:46Z",
            "source": "reversing-labs",
            "id": "RLUA-2026-00041",
            "import_time": "2026-03-19T12:19:20.436080127Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / aiohappyeyeball

Package

Name
aiohappyeyeball
View open source insights on deps.dev
Purl
pkg:pypi/aiohappyeyeball

Affected ranges

Affected versions

2.*
2.6.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/aiohappyeyeball/MAL-2025-191616.json"