1 line
2.3 KiB
JSON
1 line
2.3 KiB
JSON
{"schema_version":"1.9.2","id":"MAL-2026-19202","published":"2026-11-12T22:25:26Z","modified":"2026-11-12T23:15:03.232776444Z","summary":"Malicious code in dashloom (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (ba0285d49d46cd93cdcad1582bb1c013beb3791dc901a0a3c96f3801dba9d909)\nThis package is prepared to be used as a malicious loader. It pins pydash dependency in a vulnerable version allowing reaching out of the object scope when calling `pydash.invoke(...)`. The code to reach it is intended to be delivered from the now-benign GitHub file, which is then splited and passed to the vulnerable function. The same Github user account is also involved in publishing a repository that executes embedded encrypted code when called with specific arguments. The package was originally flagged by PyPI Security.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-dashloom\n\n\nReasons (based on the campaign):\n\n\n - action-hidden-in-lib-usage\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"dashloom","ecosystem":"PyPI","purl":"pkg:pypi/dashloom"},"versions":["1.0.0","1.1.0","1.1.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dashloom/MAL-2026-19202.json"}}],"references":[{"type":"WEB","url":"https://github.com/secure-file-crypter/secure-file-crypter/blob/d139e9955a08528126897f8ed7949f6c6b6891b4/src/pre-post-encrypt.js#L1"},{"type":"WEB","url":"https://github.com/dgilland/pydash/blob/b6bd031de47134b8e3c3977fbe65bf13cc51a205/CHANGELOG.rst?plain=1#L291"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/dashloom"}],"database_specific":{"iocs":{"urls":["https://github.com/dash-loom/dashloom-helper/blob/main/src/dashloom_helper/helper.txt"]},"malicious-packages-origins":[{"id":"pypi/2026-11-dashloom/dashloom","import_time":"2026-11-12T23:09:52.557746197Z","modified_time":"2026-11-12T22:25:26.740092Z","sha256":"ba0285d49d46cd93cdcad1582bb1c013beb3791dc901a0a3c96f3801dba9d909","source":"kam193","versions":["1.0.0","1.1.0","1.1.1"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} |