MAL-2026-96

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pycolorom/MAL-2026-96.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-96

Published

2026-01-06T14:21:10Z

Modified

2026-07-20T06:32:29Z

Summary

Malicious code in pycolorom (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (6babcee81c12759b66be4c0a8ba33c3f0272b052a47fda31227f4a6087ba8e5b)

The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-10-speedd-testing-bot

Reasons (based on the campaign):

rat
Downloads and executes a remote malicious script.
typosquatting

Database specific

{
    "iocs":  {
        "domains":  [
            "server-unlock-hack.onrender.com"
        ],
        "urls":  [
            "https://pastebin.com/raw/xAT1vudj",
            "https://i7trak-id3i.onrender.com",
            "https://pastebin.com/raw/M3Rh68JJ"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2025-10-speedd-testing-bot/pycolorom",
            "import_time":  "2026-01-06T14:41:24.199034212Z",
            "modified_time":  "2026-01-06T14:21:10.810094Z",
            "sha256":  "6babcee81c12759b66be4c0a8ba33c3f0272b052a47fda31227f4a6087ba8e5b",
            "source":  "kam193",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "pypi/2025-10-speedd-testing-bot/pycolorom",
            "import_time":  "2026-01-12T23:35:38.65995904Z",
            "modified_time":  "2026-01-06T14:21:10.810094Z",
            "sha256":  "52206f99bec4bc356ae9efc68430a8412d28d1e80a7d25a8108dc0acda81c6af",
            "source":  "kam193",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "pypi/2025-10-speedd-testing-bot/pycolorom",
            "import_time":  "2026-01-18T23:07:34.010275904Z",
            "modified_time":  "2026-01-06T14:21:10.810094Z",
            "sha256":  "a8c2ce5dba961bbfdc0f303b0a3ec633d35ba030e03bd076a432d1833bf78997",
            "source":  "kam193",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "pypi/2025-10-speedd-testing-bot/pycolorom",
            "import_time":  "2026-02-26T09:49:02.329298925Z",
            "modified_time":  "2026-01-06T14:21:10.810094Z",
            "sha256":  "26f5d6d03dee6f6daa76be41653ef85c46e10a2e69c13ac10bc03d9c7576a427",
            "source":  "kam193",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "pypi/2025-10-speedd-testing-bot/pycolorom",
            "import_time":  "2026-07-20T06:05:22.556861576Z",
            "modified_time":  "2026-01-06T14:21:10.810094Z",
            "sha256":  "c114abd4501f0958c2911a567b65f560435c5abfa0c3ffbfeb89c4bf8ef67a68",
            "source":  "kam193",
            "versions":  [
                "1.0.1"
            ]
        }
    ]
}

References

Credits

- Kamil Mańkowski (kam193) - REPORTER
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / pycolorom

Package

Name: pycolorom; View open source insights on deps.dev
Purl: pkg:pypi/pycolorom

Affected ranges

Affected versions

1.*

1.0.1

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pycolorom/MAL-2026-96.json"