MAL-2025-191622

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/donotinstall/MAL-2025-191622.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-191622
Published
2025-10-26T19:33:38Z
Modified
2026-03-19T12:52:43.608068Z
Summary
Malicious code in donotinstall (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (a0c56680f6f4db81ec1ad0691253d592055a3581b00e9c93e3dfd6d448b63212)

Package contains obfuscated reverse shell. However, it connects with a local IP only, thus it's much more a test than a malicious action

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: 2025-10-donotinstall

Reasons (based on the campaign):

  • The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.

  • obfuscation

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "RLMA-2025-05590",
            "modified_time": "2025-12-01T12:54:14Z",
            "versions": [
                "1"
            ],
            "source": "reversing-labs",
            "import_time": "2025-12-02T09:09:36.270831067Z",
            "sha256": "94ed4ebff18057da5526637d1150d8cc470f20112bacca2f43bab949d14216f2"
        },
        {
            "id": "pypi/2025-10-donotinstall/donotinstall",
            "modified_time": "2025-10-26T19:33:38.499621Z",
            "versions": [
                "1.0"
            ],
            "source": "kam193",
            "import_time": "2025-12-02T22:30:56.000474102Z",
            "sha256": "fecfc822a8976103368c32882bbc7c420938c161e019165d9acd67cb08e2f45a"
        },
        {
            "id": "pypi/2025-10-donotinstall/donotinstall",
            "modified_time": "2025-10-26T19:33:38.499621Z",
            "versions": [
                "1.0"
            ],
            "source": "kam193",
            "import_time": "2025-12-02T23:07:19.195355137Z",
            "sha256": "a0c56680f6f4db81ec1ad0691253d592055a3581b00e9c93e3dfd6d448b63212"
        },
        {
            "id": "RLUA-2026-00279",
            "modified_time": "2026-03-18T12:13:23Z",
            "import_time": "2026-03-19T12:19:41.426894648Z",
            "source": "reversing-labs",
            "sha256": "00b412c8982f5407430b6b2adb21986e7460d0959c429e13997fc14072f9c0e7"
        }
    ]
}
References
Credits

Affected packages

PyPI / donotinstall

Package

Name
donotinstall
View open source insights on deps.dev
Purl
pkg:pypi/donotinstall

Affected ranges

Affected versions

Other
1
1.*
1.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/donotinstall/MAL-2025-191622.json"