🛡️ MAL-2025-5102 — coloraiz

Malicious code in coloraiz (PyPI)

Source: kam193

The package imitates colorama, and places a proxy object over the original colorama module that on every usage executes a remote code. The remote script installs a backdoor through legitimate tunnelling software and upload access credentials to the attacker.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-05-coloraiz

Reasons (based on the campaign):

• impersonation
• clones-real-package
• action-hidden-in-lib-usage
• backdoor
• Downloads and executes a remote malicious script.