MAL-2025-6515

    Dashboard / Malicious Package / MAL-2025-6515

    MAL-2025-6515

    Published: 9 Jul 2025Last Modified: 19 Mar 2026

    Summary: Malicious code in graphdict (PyPI)

    Details: Source: kam193 (d6536224bd962025c65671a0007df1998dbc9485dfb2d628b0a0d57ab916487e) Malicious clone of legitimate networkx package with added hidden encrypted code. The exact behaviour unclear as it uses decryption key based on the arguments and config files Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-graphdict Reasons (based on the campaign): - Downloads and executes a remote malicious script. - obfuscation - clones-real-package

    References: https://bad-packages.kam193.eu/pypi/package/graphdict, https://www.reversinglabs.com/blog/fake-recruiter-campaign-crypto-devs, https://www.reversinglabs.com/blog/fake-recruiter-campaign-crypto-devs

    Affected packages

    Package

    Name: graphdict

    Purl: pkg:pypi/graphdict

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.4.0
    3.4.2
    3.4.6
    3.4.8
    3.4.10
    3.4.11
    3.4.12
    3.4.13
    3.4.14
    MAL-2025-6515 | CVE-DB