MAL-2025-41699

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/m5tlprovetomegz/MAL-2025-41699.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-41699
Published
2025-07-24T23:11:21Z
Modified
2026-03-19T12:54:32Z
Summary
Malicious code in m5tlprovetomegz (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (41041b6e55e23e7b8d40be5bb95a75fdba5b64cb9524c86054deabcd2177e459)

Importing the module starts downloading and executing a file recognized as malicious by AVs

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-07-m5tlprovetomegz

Reasons (based on the campaign):

  • malware

  • Downloads and executes a remote executable.

Database specific 
{
    "iocs":  {
        "urls":  [
            "https://github.com/GrayHATGroupx69/Simple-Obsfacture/raw/refs/heads/main/x695test.exe"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "RLMA-2025-04193",
            "import_time":  "2025-08-29T06:41:47.059689055Z",
            "modified_time":  "2025-08-28T07:11:20Z",
            "sha256":  "0d9b7dc8331eb2997090234ca73a4aa5d69579bc6ac6bcd3f4621a80afc68377",
            "source":  "reversing-labs",
            "versions":  [
                "0.1.0",
                "0.1.1"
            ]
        },
        {
            "id":  "pypi/2025-07-m5tlprovetomegz/m5tlprovetomegz",
            "import_time":  "2025-12-02T22:30:55.320476291Z",
            "modified_time":  "2025-07-24T23:11:21.747742Z",
            "ranges":  [
                {
                    "events":  [
                        {
                            "introduced":  "0"
                        }
                    ],
                    "type":  "ECOSYSTEM"
                }
            ],
            "sha256":  "687b85e4f704918e8e36ad13bfeba2bed752cfca080c5467343c7e35da45fded",
            "source":  "kam193"
        },
        {
            "id":  "pypi/2025-07-m5tlprovetomegz/m5tlprovetomegz",
            "import_time":  "2025-12-02T23:07:18.347712907Z",
            "modified_time":  "2025-07-24T23:11:21.747742Z",
            "ranges":  [
                {
                    "events":  [
                        {
                            "introduced":  "0"
                        }
                    ],
                    "type":  "ECOSYSTEM"
                }
            ],
            "sha256":  "41041b6e55e23e7b8d40be5bb95a75fdba5b64cb9524c86054deabcd2177e459",
            "source":  "kam193"
        },
        {
            "id":  "pypi/2025-07-m5tlprovetomegz/m5tlprovetomegz",
            "import_time":  "2025-12-10T21:38:57.580788048Z",
            "modified_time":  "2025-07-24T23:11:21.747742Z",
            "sha256":  "e89a518d28a92f592fdc055887892c42b310aa627ecf14f0370b0f2bd4844d26",
            "source":  "kam193",
            "versions":  [
                "0.1.0",
                "0.1.1"
            ]
        },
        {
            "id":  "RLUA-2026-00485",
            "import_time":  "2026-03-19T12:20:00.717553368Z",
            "modified_time":  "2026-03-18T12:15:45Z",
            "sha256":  "285b3e80ec0896f9baaa87380294109a6781eab577204546cdb812441ffdec35",
            "source":  "reversing-labs"
        }
    ]
}
References
Credits

Affected packages

PyPI / m5tlprovetomegz

Package

Name
m5tlprovetomegz
View open source insights on deps.dev
Purl
pkg:pypi/m5tlprovetomegz

Affected ranges

Affected versions

0.*
0.1.0
0.1.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/m5tlprovetomegz/MAL-2025-41699.json"