MAL-2025-47797

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-dateitil/MAL-2025-47797.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-47797
Published
2025-08-27T09:09:27Z
Modified
2026-03-19T12:56:04.747915Z
Summary
Malicious code in python-dateitil (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (f7d09226c2d76a03909b10c844a44149abf2606a5f1f55232ee7620580835787)

Package consist of a revshell only. The effective danger is low as it's clearly designed to connect to a localhost only and be used as awareness.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: 2025-08-python-dateitil

Reasons (based on the campaign):

  • typosquatting

  • The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2025-09-26T09:14:29Z",
            "source": "reversing-labs",
            "import_time": "2025-09-26T11:05:35.619530766Z",
            "id": "RLMA-2025-04804",
            "versions": [
                "0.1.2"
            ],
            "sha256": "b4f5db77eb7b6407fc4bffd35b7d4c4b1bfbdc3fdf7b7bc155ecfaaab693e73b"
        },
        {
            "modified_time": "2025-08-27T09:09:27.653501Z",
            "source": "kam193",
            "import_time": "2025-12-02T22:30:56.336313038Z",
            "id": "pypi/2025-08-python-dateitil/python-dateitil",
            "versions": [
                "0.1.2"
            ],
            "sha256": "07e335e1dfcc04360bbc65bfec95429d985ae8989aacd22b9bbffdde8c1ab3eb"
        },
        {
            "modified_time": "2025-08-27T09:09:27.653501Z",
            "source": "kam193",
            "import_time": "2025-12-02T23:07:19.526057811Z",
            "id": "pypi/2025-08-python-dateitil/python-dateitil",
            "versions": [
                "0.1.2"
            ],
            "sha256": "f7d09226c2d76a03909b10c844a44149abf2606a5f1f55232ee7620580835787"
        },
        {
            "source": "reversing-labs",
            "import_time": "2026-03-19T12:20:17.741951415Z",
            "id": "RLUA-2026-00656",
            "modified_time": "2026-03-18T12:17:43Z",
            "sha256": "29db1111a20ffcd79894d736ead141458777c1d9aa591e744f02bc11eef64a98"
        }
    ]
}
References
Credits

Affected packages

PyPI / python-dateitil

Package

Name
python-dateitil
View open source insights on deps.dev
Purl
pkg:pypi/python-dateitil

Affected ranges

Affected versions

0.*
0.1.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-dateitil/MAL-2025-47797.json"