MAL-2025-6478

    Dashboard / Malicious Package / MAL-2025-6478

    MAL-2025-6478

    Published: 6 Jul 2025Last Modified: 19 Mar 2026

    Summary: Malicious code in cloudscrapersafe (PyPI)

    Details: Source: kam193 (2420d6a750823b640af4d97d3a2a26383ce9e32d3ac266e4792675e8beb9b806) During processing the user requests, the package looks for URLs related to checkouts using services: - credomatic.compassmerchantsolutions.com - checkout.baccredomatic.com and exfiltrates given credit card numbers, verification codes etc. Interestingly, it checks even 3DS responses. Clone of the legitimate "cloudscraper" package. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-cloudscrapersafe Reasons (based on the campaign): - action-hidden-in-lib-usage - exfiltration-generic - clones-real-package

    References: https://bad-packages.kam193.eu/pypi/package/cloudscrapersafe

    Affected packages

    Package

    Name: cloudscrapersafe

    Purl: pkg:pypi/cloudscrapersafe

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.0.0
    MAL-2025-6478 | CVE-DB