{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "myproject-bola"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)",
      "type": "REPORTER"
    },
    {
      "contact": [
        "https://www.reversinglabs.com"
      ],
      "name": "ReversingLabs",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "pypi/2026-02-isb/myproject-bola",
        "import_time": "2026-02-28T20:41:32.300847165Z",
        "modified_time": "2026-02-28T20:25:57.91926Z",
        "sha256": "f85bf2df7a8a311b7140ca4086746ecf3c26b219843b96c1f9f8c22f505e7edc",
        "source": "kam193",
        "versions": [
          "1.0.0"
        ]
      },
      {
        "id": "RLMA-2026-00549",
        "import_time": "2026-03-19T12:18:18.742617839Z",
        "modified_time": "2026-03-18T12:16:24Z",
        "sha256": "7e4ed9676dffc5e3134fe1121786a0fddba370b96cde2d909d2417232de61f7f",
        "source": "reversing-labs",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (f85bf2df7a8a311b7140ca4086746ecf3c26b219843b96c1f9f8c22f505e7edc)\nStarting the module initiates an infostealer with a Telegram bot and RAT-like functionality and hardcoded credentials. The code automatically adds itself to autostart, collects some credentials, and also awaits further commands. The code is capable of exfiltrating browser data, files, taking screenshots, recording audio and modifying some system configurations.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-02-isb\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - exfiltration-browser-data\n\n\n - exfiltration-credentials\n\n\n - peristence-autorun\n\n\n - rat\n\n\n - spyware-like\n\n\n - files-exfiltration\n\n\n - iritating-computer-activity\n",
  "id": "MAL-2026-1091",
  "modified": "2026-03-19T12:23:25Z",
  "published": "2026-02-28T20:25:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/myproject-bola"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in myproject-bola (PyPI)"
}