MAL-2025-2621

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/bsb-backup/MAL-2025-2621.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-2621
Published
2025-03-24T10:27:00Z
Modified
2025-03-24T10:27:00Z
Summary
Malicious code in bsb-backup (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: Oracle using Macaron (7c8850cc513318b8ede38268eed0fee01ba44c81087cd289294b63bada9f394c)

This package decodes and executes a script during installation to set up a Telegram bot for device event monitoring. However, the code is obfuscated, making it difficult to comprehend and obscuring its true intent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2025-03-24T10:27:00Z",
            "import_time": "2025-03-24T10:27:00Z",
            "versions": [
                "2.0"
            ],
            "source": "Oracle using Macaron",
            "sha256": "7c8850cc513318b8ede38268eed0fee01ba44c81087cd289294b63bada9f394c"
        }
    ]
}
References
Credits

Affected packages

PyPI / bsb-backup

Package

Name
bsb-backup
View open source insights on deps.dev
Purl
pkg:pypi/bsb-backup

Affected ranges

Affected versions

2.*

2.0