MAL-2024-11657 Malicious code in pdf2doc (PyPI)

During installation, the code attempts to exfiltrate basic data (username, host name) and send to the attacker. The package looks to be a clone of an existing one

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2024-09-pdf2doc

Reasons (based on the campaign):

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

• typosquatting

• obfuscation

• dependency-confusion

• The package overrides the install command in setup.py to execute malicious code during installation.

• clones-real-package