MAL-2025-192961

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/awsutil/MAL-2025-192961.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-192961
Published
2025-12-29T21:57:34Z
Modified
2025-12-31T02:52:30Z
Summary
Malicious code in awsutil (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (86d4af9fafbcfb6e3789a38b426c744e4ac67da10eb1fa225be3a715189fb1c2)

Dependency confusion research package with advanced module-mocking

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: 2025-12-sec-lab-it

Reasons (based on the campaign):

  • dependency-confusion

  • The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

  • typosquatting

Database specific 
{
    "iocs": {
        "domains": [
            "dependency-confusion.sec-lab.it",
            "b32.simplest-solutions.pl",
            "simplest-solutions.pl",
            "sec-lab.it"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2025-12-sec-lab-it/awsutil",
            "import_time": "2025-12-29T22:07:32.546087914Z",
            "modified_time": "2025-12-29T21:57:34.570356Z",
            "sha256": "86d4af9fafbcfb6e3789a38b426c744e4ac67da10eb1fa225be3a715189fb1c2",
            "source": "kam193",
            "versions": [
                "99.99.99",
                "0.1.1",
                "0.1.0"
            ]
        },
        {
            "id": "pypi/2025-12-sec-lab-it/awsutil",
            "import_time": "2025-12-30T22:39:04.266995999Z",
            "modified_time": "2025-12-29T21:57:34.570356Z",
            "sha256": "a5e82ba558a433d625bbaf8e06e6f6c7edfcdfd93735be5448761ce39949043f",
            "source": "kam193",
            "versions": [
                "0.1.0",
                "0.1.1",
                "99.99.99"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / awsutil

Package

Name
awsutil
View open source insights on deps.dev
Purl
pkg:pypi/awsutil

Affected ranges

Affected versions

0.*
0.1.0
0.1.1
99.*
99.99.99

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/awsutil/MAL-2025-192961.json"