MAL-2025-191688

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/axonify/MAL-2025-191688.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-191688
Published
2025-03-18T09:49:12Z
Modified
2025-12-31T02:52:30Z
Summary
Malicious code in axonify (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (22991c04631c7553b040a72573bc7d0ad80886ab6bc834ac43f1e1611f85ea02)

The package is capable of installing malware from a hardcoded URL. The malware is well-recognized and acts as infostealer. Interestingly, it uses Steam profiles to get the current C2 domain (based on sandbox analysis).

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-03-logax

Reasons (based on the campaign):

  • infostealer

  • malware

Database specific 
{
    "iocs": {
        "domains": [
            "acerputas.90shipsnormal.site"
        ],
        "urls": [
            "https://anonfile.io/api/download/rzOy11HD",
            "https://anonfile.io/api/download/iJbMXihN",
            "https://store4.gofile.io/download/web/dcec487f-df79-4ec0-99d1-ac2cc299329a/Saucy.exe",
            "https://steamcommunity.com/profiles/76561199830115115/",
            "https://acerputas.90shipsnormal.site/api/log"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2025-03-logax/axonify",
            "import_time": "2025-12-02T22:30:54.963121889Z",
            "modified_time": "2025-03-18T09:49:12Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "ECOSYSTEM"
                }
            ],
            "sha256": "18750101071446d59ebfb47402bdf49a6d5adf9ff2482f5cd735e59787cdec72",
            "source": "kam193"
        },
        {
            "id": "pypi/2025-03-logax/axonify",
            "import_time": "2025-12-02T23:07:18.002236006Z",
            "modified_time": "2025-03-18T09:49:12Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "ECOSYSTEM"
                }
            ],
            "sha256": "22991c04631c7553b040a72573bc7d0ad80886ab6bc834ac43f1e1611f85ea02",
            "source": "kam193"
        },
        {
            "id": "pypi/2025-03-logax/axonify",
            "import_time": "2025-12-10T21:38:57.30397887Z",
            "modified_time": "2025-03-18T09:49:12Z",
            "sha256": "1340be50ea1782d5b4e435dbdaeae4e50ded6272850772c2cc3bb8acac5ea32b",
            "source": "kam193",
            "versions": [
                "6.2",
                "7.6",
                "1.0",
                "8.0",
                "8.5",
                "9.0",
                "10.0"
            ]
        },
        {
            "id": "pypi/2025-03-logax/axonify",
            "import_time": "2025-12-30T22:39:04.045549571Z",
            "modified_time": "2025-03-18T09:49:12Z",
            "sha256": "4971089247edf555cafc9a8a81777da6a11bbd10b67acc05ef183b3987fb83c9",
            "source": "kam193",
            "versions": [
                "1.0",
                "6.2",
                "7.6",
                "8.0",
                "8.5",
                "9.0",
                "10.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / axonify

Package

Name
axonify
View open source insights on deps.dev
Purl
pkg:pypi/axonify

Affected ranges

Affected versions

1.*
1.0
6.*
6.2
7.*
7.6
8.*
8.0
8.5
9.*
9.0
10.*
10.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/axonify/MAL-2025-191688.json"