MAL-2025-41734

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/rbx1325/MAL-2025-41734.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-41734
Published
2025-07-18T20:40:32Z
Modified
2026-03-19T12:56:14.972558Z
Summary
Malicious code in rbx1325 (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (7895e3c185d37126abdb72411a2b02b7d78325ca51e4cecd4303e282608b8966)

During installation, package attempts to exfiltrate browser data

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-07-rbx1325

Reasons (based on the campaign):

  • infostealer

  • exfiltration-browser-data

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.1.0"
            ],
            "id": "RLMA-2025-04229",
            "modified_time": "2025-08-28T07:11:41Z",
            "import_time": "2025-08-29T06:41:50.788253362Z",
            "sha256": "bebe5dee3157ccb6a495d4d05e497bac97a003eacb695176f14e5a4a0234f044",
            "source": "reversing-labs"
        },
        {
            "id": "pypi/2025-07-rbx1325/rbx1325",
            "modified_time": "2025-07-18T20:40:32.006437Z",
            "import_time": "2025-12-02T22:30:55.521574201Z",
            "sha256": "13681017d263eab485a0645af37533752ade33fbf178268e5d0db204b9891fb5",
            "ranges": [
                {
                    "type": "ECOSYSTEM",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "source": "kam193"
        },
        {
            "id": "pypi/2025-07-rbx1325/rbx1325",
            "modified_time": "2025-07-18T20:40:32.006437Z",
            "import_time": "2025-12-02T23:07:18.558268526Z",
            "sha256": "7895e3c185d37126abdb72411a2b02b7d78325ca51e4cecd4303e282608b8966",
            "ranges": [
                {
                    "type": "ECOSYSTEM",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "source": "kam193"
        },
        {
            "versions": [
                "0.1.0"
            ],
            "id": "pypi/2025-07-rbx1325/rbx1325",
            "modified_time": "2025-07-18T20:40:32.006437Z",
            "import_time": "2025-12-10T21:38:57.7674571Z",
            "sha256": "8ea5380ef3608fd1dc30aae353de53e9478e90b4b5d454c177a5b175ae0cde89",
            "source": "kam193"
        },
        {
            "id": "RLUA-2026-00688",
            "modified_time": "2026-03-18T12:18:01Z",
            "import_time": "2026-03-19T12:20:20.609826608Z",
            "sha256": "f68819e4bb4fc0991b2bb865f74961b5eeb856ef43fc83a9a75591eb3b073a9a",
            "source": "reversing-labs"
        }
    ]
}
References
Credits

Affected packages

PyPI / rbx1325

Package

Name
rbx1325
View open source insights on deps.dev
Purl
pkg:pypi/rbx1325

Affected ranges

Affected versions

0.*
0.1.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/rbx1325/MAL-2025-41734.json"