MAL-2025-191841

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-rootpath/MAL-2025-191841.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-191841
Published
2025-11-12T20:57:18Z
Modified
2026-03-19T12:56:03Z
Summary
Malicious code in python-rootpath (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (bb867560d676e7b79ce110b230906a9630feb223cbcb6072bff5a2636c60a3c7)

Hidden code downloads, saves and import a remote script. The package itself is a clone of a legitimate "rootpath". At the time of analysis, the remote script did not do any harmful action

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-11-python-rootpath

Reasons (based on the campaign):

  • Downloads and executes a remote malicious script.

  • clones-real-package

Database specific 
{
    "iocs": {
        "urls": [
            "https://pastebin.com/raw/mPx5K6DN"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2025-11-python-rootpath/python-rootpath",
            "import_time": "2025-12-02T22:30:55.492963433Z",
            "modified_time": "2025-11-12T20:57:18.207133Z",
            "sha256": "894d7db316da52e9be82cf9fc3b3c09a36a51beca269246cbc823de15005ee2e",
            "source": "kam193",
            "versions": [
                "0.1.9",
                "0.1.7"
            ]
        },
        {
            "id": "pypi/2025-11-python-rootpath/python-rootpath",
            "import_time": "2025-12-02T23:07:18.517869479Z",
            "modified_time": "2025-11-12T20:57:18.207133Z",
            "sha256": "bb867560d676e7b79ce110b230906a9630feb223cbcb6072bff5a2636c60a3c7",
            "source": "kam193",
            "versions": [
                "0.1.9",
                "0.1.7"
            ]
        },
        {
            "id": "RLMA-2025-06584",
            "import_time": "2025-12-24T10:07:31.11011233Z",
            "modified_time": "2025-12-23T08:39:31Z",
            "sha256": "63d4c44546eaa9b33dc5fe1745f42e2966888ec5bb73df4369f8cdd982501fe2",
            "source": "reversing-labs",
            "versions": [
                "0.1.1",
                "0.1.2",
                "0.1.3",
                "0.1.5",
                "0.1.6",
                "0.1.7",
                "0.1.8",
                "0.1.9"
            ]
        },
        {
            "id": "pypi/2025-11-python-rootpath/python-rootpath",
            "import_time": "2025-12-30T22:39:04.146549882Z",
            "modified_time": "2025-11-12T20:57:18.207133Z",
            "sha256": "e4dd471edee03aeb7579dbbbdbefa7594da826040e16473e4a99bf889788e832",
            "source": "kam193",
            "versions": [
                "0.1.7",
                "0.1.9"
            ]
        },
        {
            "id": "RLUA-2026-00667",
            "import_time": "2026-03-19T12:20:18.711153455Z",
            "modified_time": "2026-03-18T12:17:49Z",
            "sha256": "f7e11676db9086d1238c4a81f42abebf09a400f09290aa05e3978f05b12872e3",
            "source": "reversing-labs"
        }
    ]
}
References
Credits

Affected packages

PyPI / python-rootpath

Package

Name
python-rootpath
View open source insights on deps.dev
Purl
pkg:pypi/python-rootpath

Affected ranges

Affected versions

0.*
0.1.1
0.1.2
0.1.3
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-rootpath/MAL-2025-191841.json"