MAL-2025-191822

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/prof-qx/MAL-2025-191822.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-191822
Published
2025-07-25T21:55:27Z
Modified
2025-12-12T20:41:46.296188Z
Summary
Malicious code in prof-qx (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (eb25a7704dc642f82be2ae6a92dcd60cc3235144351fbc18cd11ca96d970c7e3)

Package silently exfiltrates user's credentials ahead of starting the promised functionality. First batch used simple code, the newer attempt to hide functionality by using compiled modules

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-07-prof-quotex

Reasons (based on the campaign):

  • action-hidden-in-lib-usage

  • A Telegram webhook is used to send collected data.

  • exfiltration-credentials

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "kam193",
            "modified_time": "2025-07-25T21:55:27.257417Z",
            "sha256": "711bf6ab8276093fd2858d062c82b1d1b802ec515332380eb0217043d8940dec",
            "id": "pypi/2025-07-prof-quotex/prof-qx",
            "ranges": [
                {
                    "type": "ECOSYSTEM",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "import_time": "2025-12-02T22:30:55.439492984Z"
        },
        {
            "source": "kam193",
            "modified_time": "2025-07-25T21:55:27.257417Z",
            "sha256": "eb25a7704dc642f82be2ae6a92dcd60cc3235144351fbc18cd11ca96d970c7e3",
            "id": "pypi/2025-07-prof-quotex/prof-qx",
            "ranges": [
                {
                    "type": "ECOSYSTEM",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "import_time": "2025-12-02T23:07:18.463215969Z"
        },
        {
            "versions": [
                "0.0.1",
                "0.0.2",
                "0.0.3",
                "0.0.4",
                "0.0.5"
            ],
            "modified_time": "2025-07-25T21:55:27.257417Z",
            "sha256": "c966ea12fdcd53ad4d921a6bea6add22b12835ca725e7de075b074eb27f3d369",
            "id": "pypi/2025-07-prof-quotex/prof-qx",
            "source": "kam193",
            "import_time": "2025-12-10T21:38:57.678286912Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / prof-qx

Package

Name
prof-qx
View open source insights on deps.dev
Purl
pkg:pypi/prof-qx

Affected ranges

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/prof-qx/MAL-2025-191822.json"