MAL-2025-982

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/selenium-plugin/MAL-2025-982.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-982
Published
2024-12-28T23:58:39Z
Modified
2026-03-19T12:56:50.103193Z
Summary
Malicious code in selenium-plugin (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (6e002fd5736f780c2fc01668d4e37d008d211fa2547b96cb960b11edd5b87d64)

During installation or importing, the package downloads a small executable and register autostart of its. While it's hard to get the full activity of the executable, it does download what appears to be an encrypted data from GitHub repo full of suspicious files, including bitcoin miners.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2024-12-selenium-plugin

Reasons (based on the campaign):

  • modify-system-without-consent

  • peristence-autorun

  • dependency-confusion

Database specific 
{
    "iocs": {
        "urls": [
            "https://raw.githubusercontent.com/AromatcHEBUYRKOS/chekingbebra/refs/heads/main/ibebbbbbbbbb.txt",
            "https://store9.gofile.io/download/web/354c4da7-4bcb-4186-9d47-847d7a0553c2/folder.zip"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "RLMA-2025-00523",
            "modified_time": "2025-02-03T17:07:53Z",
            "versions": [
                "1.0.0"
            ],
            "source": "reversing-labs",
            "import_time": "2025-02-03T18:38:09.355953688Z",
            "sha256": "3156520a78bd712fd65f997daf4bfb84e07f2002e6676c2435cd4a065837d60a"
        },
        {
            "id": "pypi/2024-12-selenium-plugin/selenium-plugin",
            "modified_time": "2024-12-28T23:58:39Z",
            "import_time": "2025-12-02T22:30:55.56582946Z",
            "source": "kam193",
            "ranges": [
                {
                    "type": "ECOSYSTEM",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "sha256": "285049dfcfb02c58999da335109b40d2e913fa10f992a35676d2541e1bfc2ad8"
        },
        {
            "id": "pypi/2024-12-selenium-plugin/selenium-plugin",
            "modified_time": "2024-12-28T23:58:39Z",
            "import_time": "2025-12-02T23:07:18.607939469Z",
            "source": "kam193",
            "ranges": [
                {
                    "type": "ECOSYSTEM",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "sha256": "6e002fd5736f780c2fc01668d4e37d008d211fa2547b96cb960b11edd5b87d64"
        },
        {
            "id": "pypi/2024-12-selenium-plugin/selenium-plugin",
            "modified_time": "2024-12-28T23:58:39Z",
            "versions": [
                "1.0.0"
            ],
            "source": "kam193",
            "import_time": "2025-12-10T21:38:57.810547354Z",
            "sha256": "74e6f3af3efac275c26e4e4b9393e44b120297adce8c0cd3108f3d90d7358a5a"
        },
        {
            "id": "RLUA-2026-00750",
            "modified_time": "2026-03-18T12:18:43Z",
            "import_time": "2026-03-19T12:20:26.829540589Z",
            "source": "reversing-labs",
            "sha256": "dd5f542ff0a3ad1380076c59fbfd5949de11e3852212b9523ba1e4edb4bf0f4a"
        }
    ]
}
References
Credits

Affected packages

PyPI / selenium-plugin

Package

Name
selenium-plugin
View open source insights on deps.dev
Purl
pkg:pypi/selenium-plugin

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/selenium-plugin/MAL-2025-982.json"