MAL-2025-5102 Malicious code in coloraiz (PyPI)

The package imitates colorama, and places a proxy object over the original colorama module that on every usage executes a remote code. The remote script installs a backdoor through legitimate tunnelling software and upload access credentials to the attacker.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-05-coloraiz

Reasons (based on the campaign):

• impersonation

• clones-real-package

• action-hidden-in-lib-usage

• backdoor

• Downloads and executes a remote malicious script.