MAL-2025-41675

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/flask-tdg-cyber/MAL-2025-41675.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-41675
Published
2025-08-11T15:54:48Z
Modified
2026-04-22T23:04:33.583047Z
Summary
Malicious code in flask-tdg-cyber (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (ec9e25f8f416bf20ca51977e1d4e001cf398d79dee777ff3b12b04cab6345292)

Package is prepared for exfiltration of detailed data about the running system. The exact behaviour depends on the version: some does nothing, some exfiltrate information, some have embeded malware. The package does not run malicious functions automatically.

Obfuscated URL suggest it may be part of some targetted activity

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-08-flask-tdg-cyber

Reasons (based on the campaign):

  • exfiltration-generic

  • exfiltration-env-variables

  • obfuscation

  • malware

Database specific 
{
    "iocs": {
        "domains": [
            "api-tdgbanking.vercel.app"
        ],
        "urls": [
            "https://api-tdgbanking.vercel.app/api/coolenv?a="
        ]
    },
    "malicious-packages-origins": [
        {
            "source": "reversing-labs",
            "id": "RLMA-2025-04167",
            "modified_time": "2025-08-28T07:11:05Z",
            "sha256": "b72221d4ccbf7f773683476b86d4e07df96fd8fd4d09dcfcf4203978ce783cb3",
            "versions": [
                "0.0.7",
                "0.0.8",
                "1.0.1",
                "3.100.2"
            ],
            "import_time": "2025-08-29T06:41:44.375167905Z"
        },
        {
            "source": "kam193",
            "id": "pypi/2025-08-flask-tdg-cyber/flask-tdg-cyber",
            "modified_time": "2025-08-11T15:54:48.16694Z",
            "sha256": "8e74ec85bdcc9276120f3d8ed3d60b4b96efff4c3f4b0d0d0d4d3230ac100eb3",
            "versions": [
                "3.300.39",
                "3.100.2",
                "1.0.1",
                "0.0.8",
                "0.0.7",
                "0.0.6",
                "0.0.5",
                "0.0.4",
                "0.0.3",
                "0.0.2",
                "0.0.1"
            ],
            "import_time": "2025-12-02T22:30:55.200283185Z"
        },
        {
            "source": "kam193",
            "id": "pypi/2025-08-flask-tdg-cyber/flask-tdg-cyber",
            "modified_time": "2025-08-11T15:54:48.16694Z",
            "sha256": "ea76f6ed0fc9b4a3bf5f7bc2d3e2627d46dec2e2e7168787f482f5f44f77ebbd",
            "versions": [
                "3.300.39",
                "3.100.2",
                "1.0.1",
                "0.0.8",
                "0.0.7",
                "0.0.6",
                "0.0.5",
                "0.0.4",
                "0.0.3",
                "0.0.2",
                "0.0.1"
            ],
            "import_time": "2025-12-02T23:07:18.209344374Z"
        },
        {
            "source": "kam193",
            "id": "pypi/2025-08-flask-tdg-cyber/flask-tdg-cyber",
            "modified_time": "2025-08-11T15:54:48.16694Z",
            "sha256": "89d3bd269d5a23542059b1eb13b773a88e17254fdbfb0a734e210337f56b9841",
            "versions": [
                "0.0.1",
                "0.0.2",
                "0.0.3",
                "0.0.4",
                "0.0.5",
                "0.0.6",
                "0.0.7",
                "0.0.8",
                "1.0.1",
                "3.100.2",
                "3.300.39"
            ],
            "import_time": "2025-12-30T22:39:04.083681587Z"
        },
        {
            "source": "reversing-labs",
            "id": "RLUA-2026-00328",
            "modified_time": "2026-03-18T12:13:54Z",
            "sha256": "c2d222977dbcef6bbf0a59ff9913591848fbec4e1a2d3e96dbe1eba13af983fe",
            "versions": [
                "0.0.6",
                "0.0.1",
                "0.0.2",
                "0.0.3",
                "3.300.39",
                "0.0.5",
                "0.0.4"
            ],
            "import_time": "2026-03-19T12:19:46.028517826Z"
        },
        {
            "source": "kam193",
            "id": "pypi/2025-08-flask-tdg-cyber/flask-tdg-cyber",
            "modified_time": "2025-08-11T15:54:48.16694Z",
            "sha256": "ec9e25f8f416bf20ca51977e1d4e001cf398d79dee777ff3b12b04cab6345292",
            "versions": [
                "0.0.1",
                "0.0.2",
                "0.0.3",
                "0.0.4",
                "0.0.5",
                "0.0.6",
                "0.0.7",
                "0.0.8",
                "1.0.1",
                "3.100.2",
                "3.300.39"
            ],
            "import_time": "2026-04-22T22:48:21.844831336Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / flask-tdg-cyber

Package

Name
flask-tdg-cyber
View open source insights on deps.dev
Purl
pkg:pypi/flask-tdg-cyber

Affected ranges

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
1.*
1.0.1
3.*
3.100.2
3.300.39

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/flask-tdg-cyber/MAL-2025-41675.json"