MAL-2025-3742 Malicious code in document-inference (PyPI)

Packages that seem to be created by a legit bug bounty hunter. Designed to look like created by different organisations, they contain a couple of data exfiltration (including all env variables) and potential remote code execution (though the URL seems not to serve any code).

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-05-sl4x01

Reasons (based on the campaign):

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

• exfiltration-env-variables

• impersonation

The OpenSSF Package Analysis project identified 'document-inference' @ 0.0.2 (pypi) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.