MAL-2025-191706

    Dashboard / Malicious Package / MAL-2025-191706

    MAL-2025-191706

    Published: 27 Mar 2025Last Modified: 12 Dec 2025

    Summary: Malicious code in conn-utils (PyPI)

    Details: Source: kam193 (25be0eaa51dd4c4ba03afd81b4cfad938ceb07dacb0195a9179b46413178e086) Already during the installation, the file with slightly obfuscated code is loaded and starts exfiltrating information about the host. It especially targets information about additional indexes configured for pip. Data is exfiltrated using DNS queries Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-03-conn-utils Reasons (based on the campaign): - exfiltration-generic - obfuscation

    References: https://bad-packages.kam193.eu/pypi/package/conn-utils

    Affected packages

    Package

    Name: conn-utils

    Purl: pkg:pypi/conn-utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.6.10
    1.6.11
    MAL-2025-191706 | CVE-DB