{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "selenium-plugin",
        "purl": "pkg:pypi/selenium-plugin"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)"
    },
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)",
      "type": "REPORTER"
    },
    {
      "contact": [
        "https://www.reversinglabs.com"
      ],
      "name": "ReversingLabs",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "iocs": {
      "urls": [
        "https://raw.githubusercontent.com/AromatcHEBUYRKOS/chekingbebra/refs/heads/main/ibebbbbbbbbb.txt",
        "https://store9.gofile.io/download/web/354c4da7-4bcb-4186-9d47-847d7a0553c2/folder.zip"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "RLMA-2025-00523",
        "import_time": "2025-02-03T18:38:09.355953688Z",
        "modified_time": "2025-02-03T17:07:53Z",
        "sha256": "3156520a78bd712fd65f997daf4bfb84e07f2002e6676c2435cd4a065837d60a",
        "source": "reversing-labs",
        "versions": [
          "1.0.0"
        ]
      },
      {
        "id": "pypi/2024-12-selenium-plugin/selenium-plugin",
        "import_time": "2025-12-02T22:30:55.56582946Z",
        "modified_time": "2024-12-28T23:58:39Z",
        "ranges": [
          {
            "events": [
              {
                "introduced": "0"
              }
            ],
            "type": "ECOSYSTEM"
          }
        ],
        "sha256": "285049dfcfb02c58999da335109b40d2e913fa10f992a35676d2541e1bfc2ad8",
        "source": "kam193"
      },
      {
        "id": "pypi/2024-12-selenium-plugin/selenium-plugin",
        "import_time": "2025-12-02T23:07:18.607939469Z",
        "modified_time": "2024-12-28T23:58:39Z",
        "ranges": [
          {
            "events": [
              {
                "introduced": "0"
              }
            ],
            "type": "ECOSYSTEM"
          }
        ],
        "sha256": "6e002fd5736f780c2fc01668d4e37d008d211fa2547b96cb960b11edd5b87d64",
        "source": "kam193"
      },
      {
        "id": "pypi/2024-12-selenium-plugin/selenium-plugin",
        "import_time": "2025-12-10T21:38:57.810547354Z",
        "modified_time": "2024-12-28T23:58:39Z",
        "sha256": "74e6f3af3efac275c26e4e4b9393e44b120297adce8c0cd3108f3d90d7358a5a",
        "source": "kam193",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (6e002fd5736f780c2fc01668d4e37d008d211fa2547b96cb960b11edd5b87d64)\nDuring installation or importing, the package downloads a small executable and register autostart of its. While it\u0027s hard to get the full activity of the executable, it does download what appears to be an encrypted data from GitHub repo full of suspicious files, including bitcoin miners.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2024-12-selenium-plugin\n\n\nReasons (based on the campaign):\n\n\n - modify-system-without-consent\n\n\n - peristence-autorun\n\n\n - dependency-confusion\n",
  "id": "MAL-2025-982",
  "modified": "2025-12-11T09:27:54Z",
  "published": "2024-12-28T23:58:39Z",
  "references": [
    {
      "type": "EVIDENCE",
      "url": "URL: https://tria.ge/241228-3gv5jsvqhn/behavioral1"
    },
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/selenium-plugin"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in selenium-plugin (PyPI)"
}