MAL-2025-5102

    Dashboard / Malicious Package / MAL-2025-5102

    MAL-2025-5102

    Published: 16 May 2025Last Modified: 19 Mar 2026Aliases: 
    SNYK-PYTHON-COLORAIZ-10305008

    Summary: Malicious code in coloraiz (PyPI)

    Details: Source: kam193 (dc4606b3e3f05632a889906f4c259e329a08308382fbc27329752eb8ea6a6c3c) The package imitates colorama, and places a proxy object over the original colorama module that on every usage executes a remote code. The remote script installs a backdoor through legitimate tunnelling software and upload access credentials to the attacker. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-coloraiz Reasons (based on the campaign): - impersonation - clones-real-package - action-hidden-in-lib-usage - backdoor - Downloads and executes a remote malicious script.

    References: https://checkmarx.com/zero-post/python-pypi-supply-chain-attack-colorama, https://security.snyk.io/vuln/SNYK-PYTHON-COLORAIZ-10305008, https://bad-packages.kam193.eu/pypi/package/coloraiz

    Affected packages

    Package

    Name: coloraiz

    Purl: pkg:pypi/coloraiz

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    1.0.2
    1.0.3
    MAL-2025-5102 | CVE-DB