MAL-2025-191732 Malicious code in flask-tdg-cyberx (PyPI)

Package is prepared for exfiltration of detailed data about the running system. The exact behaviour depends on the version: some does nothing, some exfiltrate information, some have embeded malware. The package does not run malicious functions automatically.

Obfuscated URL suggest it may be part of some targetted activity

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-08-flask-tdg-cyber

Reasons (based on the campaign):

• exfiltration-generic

• exfiltration-env-variables

• obfuscation

• malware