MAL-2025-191665

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/windowsrequir/MAL-2025-191665.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-191665
Published
2025-10-26T19:27:04Z
Modified
2026-03-19T12:58:33.984568Z
Summary
Malicious code in windowsrequir (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (8b1e2404307bae09dee3c7fe01e272b488ca2da014d14ad2a740ed76c89634e8)

Package downloads and runs an obfuscated bat file, which executes malicious activity according to VirusTotal results.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-10-windowsrequir

Reasons (based on the campaign):

  • impersonation

  • Downloads and executes a remote malicious script.

  • malware

Database specific 
{
    "iocs": {
        "domains": [
            "stellar-conquest.fr"
        ],
        "urls": [
            "http://stellar-conquest.fr/launcher.bat"
        ]
    },
    "malicious-packages-origins": [
        {
            "sha256": "b2d199a1a33df939f3accf1d9998b81056910cf2364c567bfbbcd305c9533a2e",
            "id": "RLMA-2025-05643",
            "source": "reversing-labs",
            "modified_time": "2025-12-01T12:55:09Z",
            "versions": [
                "1.0.2"
            ],
            "import_time": "2025-12-02T09:09:39.854698984Z"
        },
        {
            "sha256": "ec04476a65a75afba7dec1ff16b538a6c135a5a67b55b0396fe84bc24572e0da",
            "id": "pypi/2025-10-windowsrequir/windowsrequir",
            "source": "kam193",
            "modified_time": "2025-10-26T19:27:04.084772Z",
            "versions": [
                "1.0.2"
            ],
            "import_time": "2025-12-02T22:30:55.775142858Z"
        },
        {
            "sha256": "8b1e2404307bae09dee3c7fe01e272b488ca2da014d14ad2a740ed76c89634e8",
            "id": "pypi/2025-10-windowsrequir/windowsrequir",
            "source": "kam193",
            "modified_time": "2025-10-26T19:27:04.084772Z",
            "versions": [
                "1.0.2"
            ],
            "import_time": "2025-12-02T23:07:18.81865578Z"
        },
        {
            "sha256": "35e487286749e88376e5ea97f5897b7bb9a4b8b294447c5582ffea2be510b0e8",
            "id": "RLUA-2026-00931",
            "source": "reversing-labs",
            "modified_time": "2026-03-18T12:20:38Z",
            "import_time": "2026-03-19T12:20:44.57817073Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / windowsrequir

Package

Name
windowsrequir
View open source insights on deps.dev
Purl
pkg:pypi/windowsrequir

Affected ranges

Affected versions

1.*
1.0.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/windowsrequir/MAL-2025-191665.json"