MAL-2025-191652

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/poc-suppentest/MAL-2025-191652.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-191652
Published
2025-10-17T13:59:22Z
Modified
2026-03-19T12:55:19.230848Z
Summary
Malicious code in poc-suppentest (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (34829d348b54453367c47f9936c2ea6953832cbf8396649c1d79813aabb93f4e)

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-standard-pypi-install-pentest

Reasons (based on the campaign):

  • The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

  • The package overrides the install command in setup.py to execute malicious code during installation.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "02eef6a25008d8268e1015149e8ee1198e5b3a4807d1403a126e75b3718e9192",
            "id": "RLMA-2025-05625",
            "source": "reversing-labs",
            "modified_time": "2025-12-01T12:54:49Z",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2025-12-02T09:09:38.793396733Z"
        },
        {
            "sha256": "4792e923854d4eac025d8e615b6675387d918e58a972ab6fced1a809f8d934ac",
            "id": "pypi/GENERIC-standard-pypi-install-pentest/poc-suppentest",
            "source": "kam193",
            "modified_time": "2025-10-17T13:59:22.979663Z",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2025-12-02T22:30:56.302895318Z"
        },
        {
            "sha256": "34829d348b54453367c47f9936c2ea6953832cbf8396649c1d79813aabb93f4e",
            "id": "pypi/GENERIC-standard-pypi-install-pentest/poc-suppentest",
            "source": "kam193",
            "modified_time": "2025-10-17T13:59:22.979663Z",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2025-12-02T23:07:19.491311562Z"
        },
        {
            "sha256": "0c26ef3c6e1fb3ac42f2145b8d40f1284cbae980814be9a34b1f740056856d5a",
            "id": "RLUA-2026-00597",
            "source": "reversing-labs",
            "modified_time": "2026-03-18T12:17:02Z",
            "import_time": "2026-03-19T12:20:12.688645988Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / poc-suppentest

Package

Name
poc-suppentest
View open source insights on deps.dev
Purl
pkg:pypi/poc-suppentest

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/poc-suppentest/MAL-2025-191652.json"