MAL-2025-191814

    Dashboard / Malicious Package / MAL-2025-191814

    MAL-2025-191814

    Published: 16 Nov 2025Last Modified: 19 Mar 2026

    Summary: Malicious code in perfviewer (PyPI)

    Details: Source: kam193 (ea912a2de677fa6d9ea6dbf9a792dace4d927efd46a5cb615ba8548fec4930e8) During installation, code downloads and starts an executable and a DLL library. After starting them, files are removed from the disk. The executable has been recognized as AsyncRAT This is a copy of legitimate "rich" package. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-perfviewer Reasons (based on the campaign): - Downloads and executes a remote executable. - clones-real-package - malware

    References: https://www.virustotal.com/gui/file/e0fab622ede574554c53134ab648995b141556dbc66e07b3fb1b6eeb3b890439/detection, https://tria.ge/251116-1g5mwatmbp/behavioral1, https://bad-packages.kam193.eu/pypi/package/perfviewer

    Affected packages

    Package

    Name: perfviewer

    Purl: pkg:pypi/perfviewer

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    14.2.5
    14.2.4
    14.2.3
    14.2.2
    14.2.1
    MAL-2025-191814 | CVE-DB