MAL-2024-9409

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/j5gnpfweguiwerbngpiutbgn0iutb0pfwbdfsfef/MAL-2024-9409.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2024-9409
Published
2024-10-16T21:12:32Z
Modified
2025-12-12T20:42:28.363943Z
Summary
Malicious code in j5gnpfweguiwerbngpiutbgn0iutb0pfwbdfsfef (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (d91b80430038c8f338d63c0fdb59ffe1bf16f35b1885fcf8c197b70078f980bb)

According to the description, packages should demonstrate the dependency confusion attack. The realisation is, in fact, a spamming with packages having as the only purpose reporting basic data like hostname and current working directory.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: 2024-10-lokopoil23

Reasons (based on the campaign):

  • dependency-confusion

Source: ossf-package-analysis (8c86ce5153d87458c534613605bc7080b88c28ebf2ea30c12fe8c576f28624c3)

The OpenSSF Package Analysis project identified 'j5gnpfweguiwerbngpiutbgn0iutb0pfwbdfsfef' @ 0.0.1 (pypi) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "iocs": {
        "domains": [
            "3gkkr6u2z1a9rinocp0ue4tw1n7ev4jt.oastify.com"
        ]
    },
    "malicious-packages-origins": [
        {
            "source": "ossf-package-analysis",
            "versions": [
                "0.0.1"
            ],
            "sha256": "8c86ce5153d87458c534613605bc7080b88c28ebf2ea30c12fe8c576f28624c3",
            "modified_time": "2024-10-17T12:05:49Z",
            "import_time": "2024-10-17T12:08:25.499326996Z"
        },
        {
            "source": "kam193",
            "id": "pypi/2024-10-lokopoil23/j5gnpfweguiwerbngpiutbgn0iutb0pfwbdfsfef",
            "ranges": [
                {
                    "type": "ECOSYSTEM",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "sha256": "ac082d40cb76822b485465bb431b73dec4f7e724dbe382375db435608f4033ab",
            "modified_time": "2024-10-16T21:12:32Z",
            "import_time": "2025-12-02T22:30:56.131517433Z"
        },
        {
            "source": "kam193",
            "id": "pypi/2024-10-lokopoil23/j5gnpfweguiwerbngpiutbgn0iutb0pfwbdfsfef",
            "ranges": [
                {
                    "type": "ECOSYSTEM",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "sha256": "d91b80430038c8f338d63c0fdb59ffe1bf16f35b1885fcf8c197b70078f980bb",
            "modified_time": "2024-10-16T21:12:32Z",
            "import_time": "2025-12-02T23:07:19.319833898Z"
        },
        {
            "source": "kam193",
            "id": "pypi/2024-10-lokopoil23/j5gnpfweguiwerbngpiutbgn0iutb0pfwbdfsfef",
            "versions": [
                "0.0.1"
            ],
            "sha256": "85fdb7ce03c933604e80eada1e61943e56365a074288d2e925929649dcab4348",
            "modified_time": "2024-10-16T21:12:32Z",
            "import_time": "2025-12-10T21:38:58.451955313Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / j5gnpfweguiwerbngpiutbgn0iutb0pfwbdfsfef

Package

Name
j5gnpfweguiwerbngpiutbgn0iutb0pfwbdfsfef
View open source insights on deps.dev
Purl
pkg:pypi/j5gnpfweguiwerbngpiutbgn0iutb0pfwbdfsfef

Affected ranges

Affected versions

0.*

0.0.1

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/j5gnpfweguiwerbngpiutbgn0iutb0pfwbdfsfef/MAL-2024-9409.json"