MAL-2025-191620

    Dashboard / Malicious Package / MAL-2025-191620

    MAL-2025-191620

    Published: 25 Oct 2025Last Modified: 19 Mar 2026

    Summary: Malicious code in benign-lib (PyPI)

    Details: Source: kam193 (09477b048d84611002417894ccb3265d246be0156b096a8b47776960d45e9d3d) Package hides an executable inside, and starts it when imported. The sandbox analysis shows only starting a calculator, which suggests it's a research attempt without a big harm. Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: 2025-10-benign-lib Reasons (based on the campaign): - malware - obfuscation

    References: https://www.virustotal.com/gui/file/55d6a867c72897ad721d5b56d3c98dd37fdff119bc06458c45a6a90f05e71096/behavior, https://tria.ge/251025-s3e1cafs3c/behavioral2, https://bad-packages.kam193.eu/pypi/package/benign-lib

    Affected packages

    Package

    Name: benign-lib

    Purl: pkg:pypi/benign-lib

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2025-191620 | CVE-DB