MAL-2025-47796

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-amazon-doc-utils/MAL-2025-47796.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-47796
Published
2025-08-20T16:30:57Z
Modified
2026-03-19T12:56:03.643907Z
Summary
Malicious code in python-amazon-doc-utils (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (17e1f33275376bf6eef8f0ff4a1f42b8a45bada7b53462c827f397b7554bc2b0)

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-standard-pypi-install-pentest

Reasons (based on the campaign):

  • The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

  • The package overrides the install command in setup.py to execute malicious code during installation.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.0.1"
            ],
            "sha256": "a345b2d3e36a3a68a9ae30f4a9f1d08bd487ace13a2bad3557d7395d5411e83a",
            "modified_time": "2025-09-26T09:14:28Z",
            "source": "reversing-labs",
            "id": "RLMA-2025-04803",
            "import_time": "2025-09-26T11:05:35.542788664Z"
        },
        {
            "versions": [
                "0.0.1"
            ],
            "sha256": "16536f8cfa7fc943941a47708e388ade8de3b7a7dea7a50da5b3b771240cc3e2",
            "modified_time": "2025-08-20T16:30:57.484286Z",
            "source": "kam193",
            "id": "pypi/GENERIC-standard-pypi-install-pentest/python-amazon-doc-utils",
            "import_time": "2025-12-02T22:30:56.335332506Z"
        },
        {
            "versions": [
                "0.0.1"
            ],
            "sha256": "17e1f33275376bf6eef8f0ff4a1f42b8a45bada7b53462c827f397b7554bc2b0",
            "modified_time": "2025-08-20T16:30:57.484286Z",
            "source": "kam193",
            "id": "pypi/GENERIC-standard-pypi-install-pentest/python-amazon-doc-utils",
            "import_time": "2025-12-02T23:07:19.525002719Z"
        },
        {
            "sha256": "260f5cd7a98feb36298919aa08aa16600d2e781ba2966416056b077eda71b175",
            "modified_time": "2026-03-18T12:17:41Z",
            "source": "reversing-labs",
            "id": "RLUA-2026-00652",
            "import_time": "2026-03-19T12:20:17.317242557Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / python-amazon-doc-utils

Package

Name
python-amazon-doc-utils
View open source insights on deps.dev
Purl
pkg:pypi/python-amazon-doc-utils

Affected ranges

Affected versions

0.*
0.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-amazon-doc-utils/MAL-2025-47796.json"