MAL-2025-191709

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/cti-ctf-challenges/MAL-2025-191709.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-191709
Published
2025-09-09T17:40:01Z
Modified
2025-12-31T02:53:09.373642Z
Summary
Malicious code in cti-ctf-challenges (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (1cefe6c8a9ac6ede7c6ba497cf17011bf431812980749bb0068995ebba4039d9)

If the method from the module is called, it attempts to download a malicious code (identified as msf payload) and save it locally. In the analysed version, the code starting the malicious code was commented out.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-07-web3dummycti

Reasons (based on the campaign):

  • The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.

  • action-hidden-in-lib-usage

  • Downloads and executes a remote malicious script.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2025-09-09T17:40:01.964607Z",
            "source": "kam193",
            "import_time": "2025-12-02T22:30:55.083876428Z",
            "id": "pypi/2025-07-web3dummycti/cti-ctf-challenges",
            "versions": [
                "0.1.2",
                "0.1.1",
                "0.1.0"
            ],
            "sha256": "1c8af945364e0fba34cda9b3380142e8b5488188ec068411ba89e84d63c1ecca"
        },
        {
            "modified_time": "2025-09-09T17:40:01.964607Z",
            "source": "kam193",
            "import_time": "2025-12-02T23:07:18.096566442Z",
            "id": "pypi/2025-07-web3dummycti/cti-ctf-challenges",
            "versions": [
                "0.1.2",
                "0.1.1",
                "0.1.0"
            ],
            "sha256": "1cefe6c8a9ac6ede7c6ba497cf17011bf431812980749bb0068995ebba4039d9"
        },
        {
            "modified_time": "2025-09-09T17:40:01.964607Z",
            "source": "kam193",
            "import_time": "2025-12-30T22:39:04.065634274Z",
            "id": "pypi/2025-07-web3dummycti/cti-ctf-challenges",
            "versions": [
                "0.1.0",
                "0.1.1",
                "0.1.2"
            ],
            "sha256": "c3e6812abe8c36025c79adab1c9156f7ebc995f407c4b3d0e6cc4fbd4a7e592f"
        }
    ],
    "iocs": {
        "urls": [
            "https://github.com/brojafox/hehe/raw/refs/heads/main/hehe.txt"
        ]
    }
}
References
Credits

Affected packages

PyPI / cti-ctf-challenges

Package

Name
cti-ctf-challenges
View open source insights on deps.dev
Purl
pkg:pypi/cti-ctf-challenges

Affected ranges

Affected versions

0.*
0.1.0
0.1.1
0.1.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/cti-ctf-challenges/MAL-2025-191709.json"