MAL-2025-191743

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/gpu-free-ai/MAL-2025-191743.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-191743
Published
2025-07-10T23:09:35Z
Modified
2025-12-12T20:39:49Z
Summary
Malicious code in gpu-free-ai (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (0846b9b18e7af4ddef44ca9cb92d5543ace58ee3f171080b1570c3f044749dec)

Code attempts to exfiltrate any env variable containing "key" in name. This action is triggered on multiple occasions thanks to overwriting module loading and patching.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-07-gpu-free-ai

Reasons (based on the campaign):

  • exfiltration-env-variables
Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2025-07-gpu-free-ai/gpu-free-ai",
            "import_time": "2025-12-02T22:30:55.225315263Z",
            "modified_time": "2025-07-10T23:09:35.81773Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "ECOSYSTEM"
                }
            ],
            "sha256": "e06bedb403f82354b741ed70cae2d7483b88d3dd8751993f885edd31f8e4f3ef",
            "source": "kam193"
        },
        {
            "id": "pypi/2025-07-gpu-free-ai/gpu-free-ai",
            "import_time": "2025-12-02T23:07:18.245507041Z",
            "modified_time": "2025-07-10T23:09:35.81773Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "ECOSYSTEM"
                }
            ],
            "sha256": "0846b9b18e7af4ddef44ca9cb92d5543ace58ee3f171080b1570c3f044749dec",
            "source": "kam193"
        },
        {
            "id": "pypi/2025-07-gpu-free-ai/gpu-free-ai",
            "import_time": "2025-12-10T21:38:57.51125615Z",
            "modified_time": "2025-07-10T23:09:35.81773Z",
            "sha256": "3812b164cfb6c37993bf4f7398b4f6f33be6c6f15ace0183046bfedcae029e5b",
            "source": "kam193",
            "versions": [
                "0.1.0",
                "0.2.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / gpu-free-ai

Package

Name
gpu-free-ai
View open source insights on deps.dev
Purl
pkg:pypi/gpu-free-ai

Affected ranges

Affected versions

0.*
0.1.0
0.2.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/gpu-free-ai/MAL-2025-191743.json"