MAL-2025-191685

    Dashboard / Malicious Package / MAL-2025-191685

    MAL-2025-191685

    Published: 17 Jul 2025Last Modified: 12 Dec 2025

    Summary: Malicious code in avatar-handler (PyPI)

    Details: Source: kam193 (c3750cf8fac7fc22334d1fb416e7f3af691425c669829dcc9857abdc1384bbb7) Code pretending to handling downloading an image, but in fact is prepared to download and execute a Powershell script image properties. No known usage Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-avatar-handler Reasons (based on the campaign): - obfuscation - Downloads and executes a remote malicious script.

    References: https://bad-packages.kam193.eu/pypi/package/avatar-handler

    Affected packages

    Package

    Name: avatar-handler

    Purl: pkg:pypi/avatar-handler

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2025-191685 | CVE-DB