MAL-2024-9067

    Dashboard / Malicious Package / MAL-2024-9067

    MAL-2024-9067

    Published: 1 Oct 2024Last Modified: 12 Dec 2025

    Summary: Malicious code in website-scanner (PyPI)

    Details: Source: kam193 (bab4a414e51f614858ff935138ccb2632b0ba1801566c398a699e692715ccaae) The obfuscated code in setup.py on installation collects information about the system (all possible about hardware, available resources, IP, names, etc.) and sends to a telegram webhook. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-09-website-scanner Reasons (based on the campaign): - exfiltration-generic - obfuscation - A Telegram webhook is used to send collected data. Source: ossf-package-analysis (06dde0f250e5ce430d8501b6cecadc7839daed79bdaf46415c8c59f53114fab8) The OpenSSF Package Analysis project identified 'website-scanner' @ 1.0.0 (pypi) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References: https://bad-packages.kam193.eu/pypi/package/website-scanner

    Affected packages

    Package

    Name: website-scanner

    Purl: pkg:pypi/website-scanner

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2024-9067 | CVE-DB