{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "iamenumerate",
        "purl": "pkg:pypi/iamenumerate"
      },
      "versions": [
        "1.0.0",
        "1.0.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)"
    },
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)",
      "type": "REPORTER"
    },
    {
      "contact": [
        "https://www.reversinglabs.com"
      ],
      "name": "ReversingLabs",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "iocs": {
      "domains": [
        "api.aliyun-sdk-requests.xyz",
        "aliyun-sdk-requests.xyz"
      ],
      "urls": [
        "https://api.aliyun-sdk-requests.xyz/aws",
        "https://github.com/kohlersbtuh15/accesskey_tools"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "RLMA-2025-04180",
        "import_time": "2025-08-29T06:41:45.7241062Z",
        "modified_time": "2025-08-28T07:11:11Z",
        "sha256": "fc45e73b0a04b297209ed1bb954d79f1b6547c15b4c6a22391d2c516cf4fcf33",
        "source": "reversing-labs",
        "versions": [
          "1.0.0"
        ]
      },
      {
        "id": "RLUA-2025-04775",
        "import_time": "2025-09-26T11:06:10.151490423Z",
        "modified_time": "2025-09-26T09:14:03Z",
        "sha256": "b852c726e1c63be7486fee4fcd0a140260ab125b743c70f724b3e84e4f0a4798",
        "source": "reversing-labs",
        "versions": [
          "1.0.1"
        ]
      },
      {
        "id": "pypi/2025-08-aws-enumerate/iamenumerate",
        "import_time": "2025-12-02T22:30:55.267906651Z",
        "modified_time": "2025-08-25T07:46:08.612646Z",
        "sha256": "f4f5b1e48d097fa6d8fcd93493dbf2d2c2c34ea4bcff0c2294a6488ed19da3aa",
        "source": "kam193",
        "versions": [
          "1.0.0",
          "1.0.1"
        ]
      },
      {
        "id": "pypi/2025-08-aws-enumerate/iamenumerate",
        "import_time": "2025-12-02T23:07:18.292241226Z",
        "modified_time": "2025-08-25T07:46:08.612646Z",
        "sha256": "d673b2612401a11ff219f59a9ca15986b4ce10d098f08d4beb5fbc9dc79ec554",
        "source": "kam193",
        "versions": [
          "1.0.0",
          "1.0.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (d673b2612401a11ff219f59a9ca15986b4ce10d098f08d4beb5fbc9dc79ec554)\nThis one package is clearly created as part of the campaign, but the malicious code from the previous version has been removed (no other changes). It is anyway dangerous as most probably will be updated with the malicious code later\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-08-aws-enumerate\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-generic\n\n\n - action-hidden-in-lib-usage\n\n\n - exfiltration-credentials\n",
  "id": "MAL-2025-41688",
  "modified": "2025-12-03T00:04:27Z",
  "published": "2025-08-14T23:01:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/iamenumerate"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in iamenumerate (PyPI)"
}