MAL-2025-191616

    Dashboard / Malicious Package / MAL-2025-191616

    MAL-2025-191616

    Published: 27 Oct 2025Last Modified: 19 Mar 2026

    Summary: Malicious code in aiohappyeyeball (PyPI)

    Details: Source: kam193 (c4026e5d61b51d8fb2688488995ad95c662a15084e5c4799b0e68d0962291056) Malicious copy of the legit aiohappyeyeballs package, the __pycache__/staggerd.pyc contains a suspicious binary content (which seems not to be a valid PYC) Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-10-asynhttp Reasons (based on the campaign): - typosquatting - exfiltration-generic - obfuscation - clones-real-package - native-extension

    References: https://www.cert.at/en/blog/2025/10/how-typosquatting-tricked-me-a-bit, https://www.cert.at/en/blog/2025/10/how-typosquatting-tricked-me-a-bit, https://bad-packages.kam193.eu/pypi/package/aiohappyeyeball

    Affected packages

    Package

    Name: aiohappyeyeball

    Purl: pkg:pypi/aiohappyeyeball

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.6.1
    MAL-2025-191616 | CVE-DB