MAL-2025-902 Malicious code in bancor-simulation (PyPI)
- Package
- bancor-simulation
- Registry
- PyPI
What is MAL-2025-902?
MAL-2025-902 is a malicious package in bancor-simulation, published on 1 Dec 2024.
Official description
The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration for a known application, but containing only a "telemetry" module exfiltrating basic info about the user. This package has no other purpose than collecting data about users. In addition, it appears to be largely generated by an LLM.
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: 2024-12- sajansubedi
Reasons (based on the campaign):
The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
dependency-confusion
What should I do about MAL-2025-902?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.