MAL-2025-192659

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hidden-powershell-runner-ax7/MAL-2025-192659.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2025-192659

Published

2025-12-19T08:23:06Z

Modified

2025-12-31T02:54:11.230984Z

Summary

Malicious code in hidden-powershell-runner-ax7 (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (5785c01837ec1727b89125cf1a3fec3ad941c4ff0b1246d8d16fec1dff53223a)

Importing the module downloads and starts remote executable identified as malware

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-12-foxloveyou

Reasons (based on the campaign):

malware
Downloads and executes a remote executable.

Database specific

{
    "malicious-packages-origins": [
        {
            "modified_time": "2025-12-19T08:23:06.546651Z",
            "versions": [
                "0.1.1",
                "0.1.0"
            ],
            "sha256": "5785c01837ec1727b89125cf1a3fec3ad941c4ff0b1246d8d16fec1dff53223a",
            "id": "pypi/2025-12-foxloveyou/hidden-powershell-runner-ax7",
            "source": "kam193",
            "import_time": "2025-12-19T09:39:56.058167256Z"
        },
        {
            "modified_time": "2025-12-19T08:23:06.546651Z",
            "versions": [
                "0.1.0",
                "0.1.1"
            ],
            "sha256": "b35338995e5b550abd756253b53383880e21fd0896e5a7f1bf7822b0cf051c1b",
            "id": "pypi/2025-12-foxloveyou/hidden-powershell-runner-ax7",
            "source": "kam193",
            "import_time": "2025-12-30T22:39:04.098575372Z"
        }
    ],
    "iocs": {
        "domains": [
            "3zoz.duckdns.org"
        ],
        "urls": [
            "http://3zoz.duckdns.org:1111/1234",
            "http://3zoz.duckdns.org/config"
        ]
    }
}

References

Credits

- Kamil Mańkowski (kam193) - ANALYST
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / hidden-powershell-runner-ax7

Package

Name: hidden-powershell-runner-ax7; View open source insights on deps.dev
Purl: pkg:pypi/hidden-powershell-runner-ax7

Affected ranges

Affected versions

0.*

0.1.0

0.1.1

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hidden-powershell-runner-ax7/MAL-2025-192659.json"