MAL-2025-2152

    Dashboard / Malicious Package / MAL-2025-2152

    MAL-2025-2152

    Published: 5 Mar 2025Last Modified: 12 Dec 2025

    Summary: Malicious code in certifications (PyPI)

    Details: Source: kam193 (7d51c9defecdd382c5048eb6f92b32558355b8457b2b5cd63f3d86e12e8ed35b) Package contains a reverse shell. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-03-certifications Reasons (based on the campaign): - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine. Source: ossf-package-analysis (0515ead14660dcbffe28456794b1f84f6a8416f72a81ede8833f475644c70afd) The OpenSSF Package Analysis project identified 'certifications' @ 999.999.999 (pypi) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References: https://bad-packages.kam193.eu/pypi/package/certifications

    Affected packages

    Package

    Name: certifications

    Purl: pkg:pypi/certifications

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    999.999.999
    MAL-2025-2152 | CVE-DB