{"id":"MAL-2025-192958","kind":"package","aliases":["MAL-2025-192958"],"related":[],"title":"Malicious code in smtmlib (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (e871336d0effe99cb62efeda3a287186e75c1bd4ca5770efd81718db8ababe4e)\nMalicious copy of a standard library module that during class initialization downloads and executes remote code and after that attempts to cover its tracks by overwriting itself with non-malicious code. The remote code aims to collect and exfiltrate sensitive Telegram session files.\n\nThis campaign shares infrastructure and basic methods with previous 2025-11-uzip campaign.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-12-smtblib\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - infostealer\n\n\n - target:telegram\n\n\n - exfiltration-credentials\n\n\n - action-hidden-in-lib-usage\n\n\n - covering-tracks\n\n\n - clones-real-package\n\n\n - typosquatting","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"smtmlib","fixed":[],"affected":"= 0.1.6; = 0.1.7","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2025-12-29T10:04:23+00:00","first_seen_at":"2026-11-13T02:11:13+00:00","triaged_at":"2026-11-13T02:13:11+00:00","updated_at":"2026-11-13T02:13:11+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-11':81C '-12':96C '-192958':8A,11A '-2025':7A,10A '2025':80C,95C 'action':117C 'action-hidden-in-lib-usag':116C 'aim':62C 'attempt':46C 'base':99C 'basic':76C 'campaign':72C,83C,87C,94C,102C 'categori':84C 'class':36C 'clear':89C 'clone':126C 'clones-real-packag':125C 'code':2A,42C,58C,61C 'collect':64C 'copi':28C 'cover':48C,123C 'covering-track':122C 'credenti':115C 'detail':17C 'download':38C,103C 'e871336d0effe99cb62efeda3a287186e75c1bd4ca5770efd81718db8ababe4e':26C 'edit':20C 'execut':40C,105C 'exfiltr':66C,114C 'exfiltration-credenti':113C 'file':70C 'hidden':118C 'infosteal':93C,110C 'infrastructur':74C 'initi':37C 'intent':91C 'kam193':25C 'lib':120C 'librari':32C 'like':92C 'line':23C 'mal':6A,9A 'malici':1A,13B,27C,57C,85C,90C,108C 'method':77C 'modul':33C 'non':56C 'non-malici':55C 'overwrit':52C 'packag':14B,128C 'per':15C 'previous':79C 'pypi':5A 'real':127C 'reason':98C 'remot':41C,60C,107C 'script':109C 'sensit':67C 'session':69C 'share':73C 'smtblib':97C 'smtmlib':4A,12A 'sourc':16C,24C 'standard':31C 'target':111C 'telegram':68C,112C 'track':50C,124C 'typosquat':129C 'usag':121C 'uzip':82C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["smtmlib"],"ptokens":["smtmlib"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-192958':8A,11A '-2025':7A,10A 'code':2A 'mal':6A,9A 'malici':1A 'pypi':5A 'smtmlib':4A,12A","search_b":"'malici':13B 'packag':14B","search_c":"'-11':81C '-12':96C '2025':80C,95C 'action':117C 'action-hidden-in-lib-usag':116C 'aim':62C 'attempt':46C 'base':99C 'basic':76C 'campaign':72C,83C,87C,94C,102C 'categori':84C 'class':36C 'clear':89C 'clone':126C 'clones-real-packag':125C 'code':42C,58C,61C 'collect':64C 'copi':28C 'cover':48C,123C 'covering-track':122C 'credenti':115C 'detail':17C 'download':38C,103C 'e871336d0effe99cb62efeda3a287186e75c1bd4ca5770efd81718db8ababe4e':26C 'edit':20C 'execut':40C,105C 'exfiltr':66C,114C 'exfiltration-credenti':113C 'file':70C 'hidden':118C 'infosteal':93C,110C 'infrastructur':74C 'initi':37C 'intent':91C 'kam193':25C 'lib':120C 'librari':32C 'like':92C 'line':23C 'malici':27C,57C,85C,90C,108C 'method':77C 'modul':33C 'non':56C 'non-malici':55C 'overwrit':52C 'packag':128C 'per':15C 'previous':79C 'real':127C 'reason':98C 'remot':41C,60C,107C 'script':109C 'sensit':67C 'session':69C 'share':73C 'smtblib':97C 'sourc':16C,24C 'standard':31C 'target':111C 'telegram':68C,112C 'track':50C,124C 'typosquat':129C 'usag':121C 'uzip':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2025-12-29T10:04:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2025-192958","url":"https://osv.dev/vulnerability/MAL-2025-192958","severity":"critical","published_at":"2025-12-29T10:04:23+00:00","modified_at":"2026-11-13T01:45:03+00:00","first_seen_at":"2026-11-13T02:11:13+00:00","fetched_at":"2026-11-13T02:11:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}