{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "colourfulls"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)"
    },
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)",
      "type": "REPORTER"
    }
  ],
  "database_specific": {
    "iocs": {
      "urls": [
        "https://cdn.discordapp.com/attachments/941400716956799106/942268626843619348/malveillant.exe"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "pypi/2024-08-old-colourfulls/colourfulls",
        "import_time": "2025-12-02T22:30:55.064607154Z",
        "modified_time": "2024-09-08T13:52:34Z",
        "ranges": [
          {
            "events": [
              {
                "introduced": "0"
              }
            ],
            "type": "ECOSYSTEM"
          }
        ],
        "sha256": "05361e9ae5d4e524b74277f42f1c642e882e424fa5b7b2960f3f40f54ae65de8",
        "source": "kam193"
      },
      {
        "id": "pypi/2024-08-old-colourfulls/colourfulls",
        "import_time": "2025-12-02T23:07:18.075021086Z",
        "modified_time": "2024-09-08T13:52:34Z",
        "ranges": [
          {
            "events": [
              {
                "introduced": "0"
              }
            ],
            "type": "ECOSYSTEM"
          }
        ],
        "sha256": "735ca3ff38b76e7b11c1f7b884880871427299042e250bb42e17dcf66b8c8e11",
        "source": "kam193"
      },
      {
        "id": "pypi/2024-08-old-colourfulls/colourfulls",
        "import_time": "2025-12-10T21:38:57.367556552Z",
        "modified_time": "2024-09-08T13:52:34Z",
        "sha256": "2359e28fa8ea5029c6a3a151b7ca29437b37c223577a3a9e503197488ba46cc2",
        "source": "kam193",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (735ca3ff38b76e7b11c1f7b884880871427299042e250bb42e17dcf66b8c8e11)\nOnce imported, the module attempts to download an executable, put into Discord directory and most probably trick discord to start it. The download link does not work any more, so it\u0027s not possible to say what exactly the remote file did.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2024-08-old-colourfulls\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - typosquatting\n",
  "id": "MAL-2024-12246",
  "modified": "2025-12-11T09:27:52Z",
  "published": "2024-09-08T13:52:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/colourfulls"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in colourfulls (PyPI)"
}