MAL-2024-9938 Malicious code in aiotrans (PyPI)

Package "uconst" is the package containing malicious code with multiple stage, exfiltrating basic info as well as browser data. It's put into others as dependency.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2024-08-uconst-old

Reasons (based on the campaign):

• infostealer

• Downloads and executes a remote executable.

• The malicious code is intentionally included in a dependency of the package

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.