{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "spiderxr-ai",
        "purl": "pkg:pypi/spiderxr-ai"
      },
      "versions": [
        "0.1.5",
        "0.4",
        "0.5"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)"
    },
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)",
      "type": "REPORTER"
    },
    {
      "contact": [
        "https://www.reversinglabs.com"
      ],
      "name": "ReversingLabs",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "iocs": {
      "domains": [
        "01d73592-4d64-43f7-b664-ecd679686756-00-30a5f50srzeko.janeway.replit.dev"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "RLMA-2024-11171",
        "import_time": "2024-12-09T14:38:49.375736391Z",
        "modified_time": "2024-12-09T06:51:13Z",
        "sha256": "a7e531ba72499b5f765ac29995921f02f6c555787db9b0c32d6c76b94c25cca5",
        "source": "reversing-labs",
        "versions": [
          "0.1.5",
          "0.4",
          "0.5"
        ]
      },
      {
        "id": "pypi/2024-09-spider-ai/spiderxr-ai",
        "import_time": "2025-12-02T22:30:55.608126979Z",
        "modified_time": "2024-10-02T09:16:00Z",
        "ranges": [
          {
            "events": [
              {
                "introduced": "0"
              }
            ],
            "type": "ECOSYSTEM"
          }
        ],
        "sha256": "caf9b52ada123cf3d3e432162b6ccd4a0d5b46357423613d75f939f7c626e721",
        "source": "kam193"
      },
      {
        "id": "pypi/2024-09-spider-ai/spiderxr-ai",
        "import_time": "2025-12-02T23:07:18.647908148Z",
        "modified_time": "2024-10-02T09:16:00Z",
        "ranges": [
          {
            "events": [
              {
                "introduced": "0"
              }
            ],
            "type": "ECOSYSTEM"
          }
        ],
        "sha256": "0c97841e41e7389c0df8b2d96f2a9b1c033f443358bf780c5988bf352f07608f",
        "source": "kam193"
      },
      {
        "id": "pypi/2024-09-spider-ai/spiderxr-ai",
        "import_time": "2025-12-10T21:38:57.837741368Z",
        "modified_time": "2024-10-02T09:16:00Z",
        "sha256": "ddfe776d584bafdd6a9f9eb3b42cad56b2e91298e4778a94e656756c5eb4656f",
        "source": "kam193",
        "versions": [
          "0.1.5",
          "0.5",
          "0.4"
        ]
      },
      {
        "id": "pypi/2024-09-spider-ai/spiderxr-ai",
        "import_time": "2025-12-30T22:39:04.185473047Z",
        "modified_time": "2024-10-02T09:16:00Z",
        "sha256": "3cf1210e58ac7a7db8992eaa84df5369c626d8abd7ff24889dc4eed58b2f1e45",
        "source": "kam193",
        "versions": [
          "0.1.5",
          "0.4",
          "0.5"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (0c97841e41e7389c0df8b2d96f2a9b1c033f443358bf780c5988bf352f07608f)\nEvery time the user sends a message to the AI, the user IP, message as well as the response are exfiltrated to a hardcoded telegram channel. This behaviour is not mentioned in the package description. Instead, the description lures to offer advanced features.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2024-09-spider-ai\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-generic\n\n\n - A Telegram webhook is used to send collected data.\n\n\n - action-hidden-in-lib-usage\n",
  "id": "MAL-2024-11713",
  "modified": "2025-12-31T02:45:16Z",
  "published": "2024-10-02T09:16:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/spiderxr-ai"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in spiderxr-ai (PyPI)"
}