MAL-2025-47814

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/zenomenallib/MAL-2025-47814.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-47814
Published
2025-09-09T21:22:39Z
Modified
2026-03-19T12:58:23.851835Z
Summary
Malicious code in zenomenallib (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (4c6be0b94e3c9643885ae8893cd9523bd5ad735965a16a3df64a347bd38f8016)

Package is prepared to exfiltrate sensitive files. Different packages use different places for the malicious code: it runs during importing the module, is placed in a native binary, or in the setup.py script

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-08-xenlib

Reasons (based on the campaign):

  • files-exfiltration
Database specific 
{
    "iocs": {
        "domains": [
            "xenx.lol"
        ],
        "urls": [
            "http://api.xenx.lol:14880/ssteal",
            "http://api.xenx.lol:1337/check",
            "http://apis.xenx.lol:1337/check"
        ]
    },
    "malicious-packages-origins": [
        {
            "versions": [
                "2.7.0"
            ],
            "modified_time": "2025-09-26T09:14:53Z",
            "sha256": "aaf7926d44586ea02f00b2336539321cd4a1e5b42598161df6f1209baa693bf7",
            "id": "RLMA-2025-04824",
            "source": "reversing-labs",
            "import_time": "2025-09-26T11:05:37.03511685Z"
        },
        {
            "versions": [
                "2.7.0"
            ],
            "modified_time": "2025-09-09T21:22:39.655225Z",
            "sha256": "3324eaf85f9368bc891dd089cd413ce957702dabc36c0dfc0c1280c384e3bc56",
            "id": "pypi/2025-08-xenlib/zenomenallib",
            "source": "kam193",
            "import_time": "2025-12-02T22:30:55.792365184Z"
        },
        {
            "versions": [
                "2.7.0"
            ],
            "modified_time": "2025-09-09T21:22:39.655225Z",
            "sha256": "4c6be0b94e3c9643885ae8893cd9523bd5ad735965a16a3df64a347bd38f8016",
            "id": "pypi/2025-08-xenlib/zenomenallib",
            "source": "kam193",
            "import_time": "2025-12-02T23:07:18.836054707Z"
        },
        {
            "modified_time": "2026-03-18T12:21:14Z",
            "sha256": "a684f623b574b542e54511cf3c3530dc551825eed72db6de1b1ea5584cb571e8",
            "id": "RLUA-2026-00947",
            "source": "reversing-labs",
            "import_time": "2026-03-19T12:20:45.848641128Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / zenomenallib

Package

Name
zenomenallib
View open source insights on deps.dev
Purl
pkg:pypi/zenomenallib

Affected ranges

Affected versions

2.*
2.7.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/zenomenallib/MAL-2025-47814.json"