Skip to content
OpenAdvisories
Malicious MAL-2025-191803

network-utils-simple

PyPI package · versions 1.3.3, 1.3.2, 1.3.8, 1.0.0, 1.1.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.9, 1.2.7, 1.2.8, 1.3.0, 1.3.4, 1.3.5, 1.3.6, 1.3.7

Reported Feb 14, 2025 · Updated Dec 31, 2025

If this package is installed

Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.

Details

Source: kam193 (1fd943d3243197ac153b2623548e62b4225a59f611cf13fe962bc3ced369a32d)
During installation, there is an attempt to download and execute code. The package has no real functionality.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-02-network-utils-simple

Reasons (based on the campaign):

- Downloads and executes a remote executable.

- The package overrides the install command in setup.py to execute malicious code during installation.

Indicators of compromise

Shown defanged and not clickable. Search any indicator to find other packages using it.

Domains