MAL-2025-191760

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hooktest1/MAL-2025-191760.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-191760
Published
2025-11-23T16:26:36Z
Modified
2026-03-19T12:53:30.243077Z
Summary
Malicious code in hooktest1 (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (b3e91d71ab21e3575f1354593a314d50bc188b0db7b3851040e522426a765417)

During installation, the package starts a code to retrieve and execute commands from Discord

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-11-hooktest1

Reasons (based on the campaign):

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

  • rat

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2025-11-23T16:26:36.483924Z",
            "source": "kam193",
            "import_time": "2025-12-02T22:30:55.252708367Z",
            "id": "pypi/2025-11-hooktest1/hooktest1",
            "versions": [
                "0.1.1",
                "0.1.0"
            ],
            "sha256": "a5b3c9015ababfab03306c83c75f2f7b31c76874e7e591ffaf6b12b0e3b0f543"
        },
        {
            "modified_time": "2025-11-23T16:26:36.483924Z",
            "source": "kam193",
            "import_time": "2025-12-02T23:07:18.275168109Z",
            "id": "pypi/2025-11-hooktest1/hooktest1",
            "versions": [
                "0.1.1",
                "0.1.0"
            ],
            "sha256": "b3e91d71ab21e3575f1354593a314d50bc188b0db7b3851040e522426a765417"
        },
        {
            "modified_time": "2025-12-23T08:38:42Z",
            "source": "reversing-labs",
            "import_time": "2025-12-24T10:07:30.641525728Z",
            "id": "RLMA-2025-06569",
            "versions": [
                "0.1.0",
                "0.1.1"
            ],
            "sha256": "b74fc5669380714b07015d75eada0da20479d05867676f16bd3a507eef910c0f"
        },
        {
            "modified_time": "2025-11-23T16:26:36.483924Z",
            "source": "kam193",
            "import_time": "2025-12-30T22:39:04.100274571Z",
            "id": "pypi/2025-11-hooktest1/hooktest1",
            "versions": [
                "0.1.0",
                "0.1.1"
            ],
            "sha256": "299b7470e3d470e294ff376356681640cb4f6adf3dbfabfdbdad1fc47cb9b7b2"
        },
        {
            "source": "reversing-labs",
            "import_time": "2026-03-19T12:19:52.273008201Z",
            "id": "RLUA-2026-00394",
            "modified_time": "2026-03-18T12:14:42Z",
            "sha256": "ebd6b381b33c1b8aecf0255b45a7c845de271c39fa9fb82f8109d5f87c69442c"
        }
    ]
}
References
Credits

Affected packages

PyPI / hooktest1

Package

Name
hooktest1
View open source insights on deps.dev
Purl
pkg:pypi/hooktest1

Affected ranges

Affected versions

0.*
0.1.0
0.1.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hooktest1/MAL-2025-191760.json"