mal-2025-191774
Vulnerability from ossf_malicious_packages
Published
2025-08-12 10:29
Modified
2025-12-31 02:45
Summary
Malicious code in kertash (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (3cb3ef6da7e0d1c1461bb944c5ff0e356b73e52d271afa9e94435097f1d0764f)

When using methods from the package, it downloads an obfuscated code from Github and puts it in multiple localisation. While it appears that this code is used to perform action user requested, deobfuscation reveals exfiltrating user's data instead.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-08-kertash

Reasons (based on the campaign):

  • exfiltration-generic

  • A Telegram webhook is used to send collected data.

  • obfuscation

  • action-hidden-in-lib-usage



To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "kertash"
      },
      "versions": [
        "0.1.5",
        "0.1.4"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)"
    },
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)",
      "type": "REPORTER"
    }
  ],
  "database_specific": {
    "iocs": {
      "urls": [
        "https://raw.githubusercontent.com/0xPwnme/kertash/refs/heads/main/kertash.py"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "pypi/2025-08-kertash/kertash",
        "import_time": "2025-12-02T22:30:55.29810541Z",
        "modified_time": "2025-08-12T10:29:23.351674Z",
        "sha256": "9186893a63a7ed152a9b7d37d35db076087019315d9ccf5e53b6862fc12fd5a3",
        "source": "kam193",
        "versions": [
          "0.1.5",
          "0.1.4"
        ]
      },
      {
        "id": "pypi/2025-08-kertash/kertash",
        "import_time": "2025-12-02T23:07:18.323266233Z",
        "modified_time": "2025-08-12T10:29:23.351674Z",
        "sha256": "3cb3ef6da7e0d1c1461bb944c5ff0e356b73e52d271afa9e94435097f1d0764f",
        "source": "kam193",
        "versions": [
          "0.1.5",
          "0.1.4"
        ]
      },
      {
        "id": "pypi/2025-08-kertash/kertash",
        "import_time": "2025-12-30T22:39:04.115246658Z",
        "modified_time": "2025-08-12T10:29:23.351674Z",
        "sha256": "562b62099929e8a145015ac5b08bdc0d669a9cd030f8fe524d9e523bdca392c0",
        "source": "kam193",
        "versions": [
          "0.1.4",
          "0.1.5"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (3cb3ef6da7e0d1c1461bb944c5ff0e356b73e52d271afa9e94435097f1d0764f)\nWhen using methods from the package, it downloads an obfuscated code from Github and puts it in multiple localisation. While it appears that this code is used to perform action user requested, deobfuscation reveals exfiltrating user\u0027s data instead.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-08-kertash\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-generic\n\n\n - A Telegram webhook is used to send collected data.\n\n\n - obfuscation\n\n\n - action-hidden-in-lib-usage\n",
  "id": "MAL-2025-191774",
  "modified": "2025-12-31T02:45:15Z",
  "published": "2025-08-12T10:29:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/kertash"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in kertash (PyPI)"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.