MAL-2025-47799

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-ledgercommon/MAL-2025-47799.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-47799
Published
2025-08-21T14:59:29Z
Modified
2026-04-22T21:37:27.769502Z
Summary
Malicious code in python-ledgercommon (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (d88522028116659a8646b0f7c4eb4e6218e498b49ebc36927ca0787720d3e1f9)

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-standard-pypi-install-pentest

Reasons (based on the campaign):

  • The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

  • The package overrides the install command in setup.py to execute malicious code during installation.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.56.2",
                "1.56.9",
                "1.56.10",
                "1.56.11",
                "1.56.12",
                "1.56.13",
                "1.56.14",
                "2.3.1",
                "2.3.2"
            ],
            "modified_time": "2025-09-26T09:14:30Z",
            "sha256": "ad179bc1a377cd06297c2e2f2115dc46be47eabf42f8342371c0435b433dec2f",
            "id": "RLMA-2025-04806",
            "source": "reversing-labs",
            "import_time": "2025-09-26T11:05:35.786177608Z"
        },
        {
            "versions": [
                "2.3.2",
                "2.3.1",
                "1.56.14",
                "1.56.13",
                "1.56.12",
                "1.56.11",
                "1.56.10",
                "1.56.9",
                "1.56.8",
                "1.56.7",
                "1.56.6",
                "1.56.5",
                "1.56.4",
                "1.56.3",
                "1.56.2",
                "2.3.2",
                "1.56.14",
                "1.56.2",
                "2.3.1",
                "1.56.13"
            ],
            "modified_time": "2025-08-21T15:19:17.009906Z",
            "sha256": "bfb38b2ba9b265c2e4f55f4dfedef3b1796af3ed8ec121672e1aa34c369a9a82",
            "id": "pypi/GENERIC-standard-pypi-install-pentest/python-ledgercommon",
            "source": "kam193",
            "import_time": "2025-12-02T22:30:56.345527208Z"
        },
        {
            "versions": [
                "2.3.2",
                "2.3.1",
                "1.56.14",
                "1.56.13",
                "1.56.12",
                "1.56.11",
                "1.56.10",
                "1.56.9",
                "1.56.8",
                "1.56.7",
                "1.56.6",
                "1.56.5",
                "1.56.4",
                "1.56.3",
                "1.56.2",
                "2.3.2",
                "1.56.14",
                "1.56.2",
                "2.3.1",
                "1.56.13"
            ],
            "modified_time": "2025-08-21T15:19:17.009906Z",
            "sha256": "d88522028116659a8646b0f7c4eb4e6218e498b49ebc36927ca0787720d3e1f9",
            "id": "pypi/GENERIC-standard-pypi-install-pentest/python-ledgercommon",
            "source": "kam193",
            "import_time": "2025-12-02T23:07:19.537357715Z"
        },
        {
            "versions": [
                "1.56.2",
                "1.56.2",
                "1.56.3",
                "1.56.4",
                "1.56.5",
                "1.56.6",
                "1.56.7",
                "1.56.8",
                "1.56.9",
                "1.56.10",
                "1.56.11",
                "1.56.12",
                "1.56.13",
                "1.56.13",
                "1.56.14",
                "1.56.14",
                "2.3.1",
                "2.3.1",
                "2.3.2",
                "2.3.2"
            ],
            "modified_time": "2025-08-21T15:19:17.009906Z",
            "sha256": "b44aea47181f52536bf2b5a7ef34b9b494e89e404456153f14c0b39e056628ad",
            "id": "pypi/GENERIC-standard-pypi-install-pentest/python-ledgercommon",
            "source": "kam193",
            "import_time": "2025-12-30T22:39:04.338317998Z"
        },
        {
            "modified_time": "2026-03-18T12:17:48Z",
            "sha256": "ca4ab49e6361702d27570a16cfd1e3e63e27c64036364c8e6dc4201c71909b29",
            "id": "RLUA-2026-00666",
            "source": "reversing-labs",
            "import_time": "2026-03-19T12:20:18.631650904Z"
        },
        {
            "versions": [
                "1.56.2",
                "1.56.3",
                "1.56.4",
                "1.56.5",
                "1.56.6",
                "1.56.7",
                "1.56.8",
                "1.56.9",
                "1.56.10",
                "1.56.11",
                "1.56.12",
                "1.56.13",
                "1.56.14",
                "2.3.1",
                "2.3.2"
            ],
            "modified_time": "2025-08-21T15:19:17.009906Z",
            "sha256": "6f63e34bdc5d64cc13c651615ac70a1c0e491dd52de75f50fefa97449b1242ea",
            "id": "pypi/GENERIC-standard-pypi-install-pentest/python-ledgercommon",
            "source": "kam193",
            "import_time": "2026-04-22T21:21:55.650889304Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / python-ledgercommon

Package

Name
python-ledgercommon
View open source insights on deps.dev
Purl
pkg:pypi/python-ledgercommon

Affected ranges

Affected versions

1.*
1.56.2
1.56.3
1.56.4
1.56.5
1.56.6
1.56.7
1.56.8
1.56.9
1.56.10
1.56.11
1.56.12
1.56.13
1.56.14
2.*
2.3.1
2.3.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-ledgercommon/MAL-2025-47799.json"