{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "jsonschema-utf8"
      },
      "versions": [
        "4.1.2",
        "4.1.1",
        "4.1.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)",
      "type": "REPORTER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "pypi/2025-12-loguru-utf8/jsonschema-utf8",
        "import_time": "2025-12-10T18:45:05.209011163Z",
        "modified_time": "2025-12-10T17:39:08.13079Z",
        "sha256": "61bf4fa82a7c398e580d547d641bc19e3b16ba446191da04f39dcf9cf9a41eab",
        "source": "kam193",
        "versions": [
          "4.1.2",
          "4.1.1",
          "4.1.0"
        ]
      },
      {
        "id": "pypi/2025-12-loguru-utf8/jsonschema-utf8",
        "import_time": "2025-12-30T22:39:04.109220934Z",
        "modified_time": "2025-12-10T17:39:08.13079Z",
        "sha256": "bae3458837c96ae1b3f9232719b712ca6d110a5c24099baf6c378977fa90062c",
        "source": "kam193",
        "versions": [
          "4.1.0",
          "4.1.1",
          "4.1.2"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (61bf4fa82a7c398e580d547d641bc19e3b16ba446191da04f39dcf9cf9a41eab)\nPackage clones a popular package (loguru, jsonschema, ...). While it claims to have some additional features, the real change is an added compiled native library which is silently loaded in the background during the importing of the module. The exact behavior is unknown, but the binary is obfuscated\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-12-loguru-utf8\n\n\nReasons (based on the campaign):\n\n\n - clones-real-package\n\n\n - obfuscation\n\n\n - typosquatting\n\n\n - native-extension\n",
  "id": "MAL-2025-192436",
  "modified": "2025-12-31T02:45:15Z",
  "published": "2025-12-10T17:39:08Z",
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://www.virustotal.com/gui/file/da48508c771e9a12a4a235660800683f1df40d90b814df9c6e35a8713017f363/detection"
    },
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/jsonschema-utf8"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in jsonschema-utf8 (PyPI)"
}