MAL-2025-192436

    Dashboard / Malicious Package / MAL-2025-192436

    MAL-2025-192436

    Published: 10 Dec 2025Last Modified: 31 Dec 2025

    Summary: Malicious code in jsonschema-utf8 (PyPI)

    Details: Source: kam193 (61bf4fa82a7c398e580d547d641bc19e3b16ba446191da04f39dcf9cf9a41eab) Package clones a popular package (loguru, jsonschema, ...). While it claims to have some additional features, the real change is an added compiled native library which is silently loaded in the background during the importing of the module. The exact behavior is unknown, but the binary is obfuscated Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-12-loguru-utf8 Reasons (based on the campaign): - clones-real-package - obfuscation - typosquatting - native-extension

    References: https://www.virustotal.com/gui/file/da48508c771e9a12a4a235660800683f1df40d90b814df9c6e35a8713017f363/detection, https://bad-packages.kam193.eu/pypi/package/jsonschema-utf8

    Affected packages

    Package

    Name: jsonschema-utf8

    Purl: pkg:pypi/jsonschema-utf8

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    4.1.2
    4.1.1
    4.1.0
    MAL-2025-192436 | CVE-DB