MAL-2025-192989

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/brolool4141412/MAL-2025-192989.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-192989
Published
2025-12-31T11:55:52Z
Modified
2025-12-31T12:55:10.400273Z
Summary
Malicious code in brolool4141412 (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (26b5ad1d170ede931c108f8a9d4342347b2983ae9fc5330b25ddb1dcc4132eb7)

Package tests possible malicious actions during installation by starting notepad. There is no other functionality, it's clearly a test of possible malicious actions.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-simple-tests

Reasons (based on the campaign):

  • The package overrides the install command in setup.py to execute malicious code during installation.
Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "kam193",
            "import_time": "2025-12-31T12:48:17.934668586Z",
            "id": "pypi/GENERIC-simple-tests/brolool4141412",
            "sha256": "26b5ad1d170ede931c108f8a9d4342347b2983ae9fc5330b25ddb1dcc4132eb7",
            "modified_time": "2025-12-31T11:55:52.283035Z",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / brolool4141412

Package

Name
brolool4141412
View open source insights on deps.dev
Purl
pkg:pypi/brolool4141412

Affected ranges

Affected versions

1.*

1.0.0