MAL-2025-191663

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/syschecker/MAL-2025-191663.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-191663
Published
2025-10-26T19:28:00Z
Modified
2026-03-19T12:57:10.551325Z
Summary
Malicious code in syschecker (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (81ab746bf511a8c6c41c5776e5688c310a5255c65fda0fad65e31b1ed534dc91)

Package downloads and runs an obfuscated bat file, which executes malicious activity according to VirusTotal results.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-10-windowsrequir

Reasons (based on the campaign):

  • impersonation

  • Downloads and executes a remote malicious script.

  • malware

Database specific 
{
    "iocs": {
        "domains": [
            "stellar-conquest.fr"
        ],
        "urls": [
            "http://stellar-conquest.fr/launcher.bat"
        ]
    },
    "malicious-packages-origins": [
        {
            "sha256": "d0e2650f83ac021e35ac310d0c8c619f764d830aa00946ad88216d551896d019",
            "id": "RLMA-2025-05641",
            "source": "reversing-labs",
            "modified_time": "2025-12-01T12:55:05Z",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2025-12-02T09:09:39.721230121Z"
        },
        {
            "sha256": "9a4acaadc3325f04ceaef679cde8994c5c045700d666cf5c25f9a5448b0f0bea",
            "id": "pypi/2025-10-windowsrequir/syschecker",
            "source": "kam193",
            "modified_time": "2025-10-26T19:28:00.829784Z",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2025-12-02T22:30:55.621165396Z"
        },
        {
            "sha256": "81ab746bf511a8c6c41c5776e5688c310a5255c65fda0fad65e31b1ed534dc91",
            "id": "pypi/2025-10-windowsrequir/syschecker",
            "source": "kam193",
            "modified_time": "2025-10-26T19:28:00.829784Z",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2025-12-02T23:07:18.662052412Z"
        },
        {
            "sha256": "f77109832365fbab9dbaad573144434177c5aee8f4913471d83de2728c1353fe",
            "id": "RLUA-2026-00794",
            "source": "reversing-labs",
            "modified_time": "2026-03-18T12:19:11Z",
            "import_time": "2026-03-19T12:20:31.239504968Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / syschecker

Package

Name
syschecker
View open source insights on deps.dev
Purl
pkg:pypi/syschecker

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/syschecker/MAL-2025-191663.json"