MAL-2025-192658

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/connections-api-hidden-runner/MAL-2025-192658.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2025-192658

Published

2025-12-19T08:23:35Z

Modified

2025-12-31T02:52:59.275566Z

Summary

Malicious code in connections-api-hidden-runner (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (ae6bedba7c21e763c5a0e27952cf75a13a7705e7681027c87a833417a2035b70)

Importing the module downloads and starts remote executable identified as malware

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-12-foxloveyou

Reasons (based on the campaign):

malware
Downloads and executes a remote executable.

Database specific

{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.1.3",
                "0.1.2"
            ],
            "sha256": "ae6bedba7c21e763c5a0e27952cf75a13a7705e7681027c87a833417a2035b70",
            "modified_time": "2025-12-19T08:23:35.004047Z",
            "source": "kam193",
            "id": "pypi/2025-12-foxloveyou/connections-api-hidden-runner",
            "import_time": "2025-12-19T09:39:56.055913018Z"
        },
        {
            "versions": [
                "0.1.2",
                "0.1.3"
            ],
            "sha256": "3fabc78b2d6a644c757f87ad701ff48d405bd332425a77b6d9157116e99238cf",
            "modified_time": "2025-12-19T08:23:35.004047Z",
            "source": "kam193",
            "id": "pypi/2025-12-foxloveyou/connections-api-hidden-runner",
            "import_time": "2025-12-30T22:39:04.060803276Z"
        }
    ],
    "iocs": {
        "urls": [
            "http://3zoz.duckdns.org:1111/1234",
            "http://3zoz.duckdns.org/config"
        ],
        "domains": [
            "3zoz.duckdns.org"
        ]
    }
}

References

Credits

- Kamil Mańkowski (kam193) - ANALYST
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / connections-api-hidden-runner

Package

Name: connections-api-hidden-runner; View open source insights on deps.dev
Purl: pkg:pypi/connections-api-hidden-runner

Affected ranges

Affected versions

0.*

0.1.2

0.1.3

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/connections-api-hidden-runner/MAL-2025-192658.json"