{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "requests-core-plugin"
      },
      "versions": [
        "2.31.5",
        "2.31.6",
        "2.31.7",
        "2.31.8",
        "2.31.9",
        "2.31.12",
        "2.31.13",
        "2.31.14",
        "2.31.15"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)",
      "type": "REPORTER"
    }
  ],
  "database_specific": {
    "iocs": {
      "ips": [
        "85.215.240.118"
      ],
      "urls": [
        "https://pastebin.com/raw/LS7Wq1x0",
        "http://85.215.240.118:8002/updates/Update.exe"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "pypi/2026-02-requests-core-plugin/requests-core-plugin",
        "import_time": "2026-02-10T19:54:11.772695578Z",
        "modified_time": "2026-02-10T19:14:49.789587Z",
        "sha256": "f7d809caa4cb4961377b3c02a06f90ce19136a36297191248a8c6cd289a809f2",
        "source": "kam193",
        "versions": [
          "2.31.5",
          "2.31.6",
          "2.31.7",
          "2.31.8",
          "2.31.9",
          "2.31.12",
          "2.31.13",
          "2.31.14",
          "2.31.15"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (f7d809caa4cb4961377b3c02a06f90ce19136a36297191248a8c6cd289a809f2)\nDuring installation, package loads obfuscated code that then downloads and starts an executable. The final executable is identified as malware and appears to have infostealer capabilities (collecting browser and Discord data).\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-02-requests-core-plugin\n\n\nReasons (based on the campaign):\n\n\n - malware\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - impersonation\n\n\n - obfuscation\n\n\n - infostealer\n",
  "id": "MAL-2026-843",
  "modified": "2026-02-10T19:14:49Z",
  "published": "2026-02-10T19:14:49Z",
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://www.virustotal.com/gui/file/1cd70bec8a88fe5b4734ee6483aa33ec79da1b6a48cb8db77bd28bc70d58c235/detection"
    },
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/requests-core-plugin"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in requests-core-plugin (PyPI)"
}