🛡️ MAL-2025-5143 — whee11

Malicious code in whee11 (PyPI)

Source: kam193

Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: SCRIPT_KIDDIE-thegoodhacker-paquete

Reasons (based on the campaign):

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
• The package overrides the install command in setup.py to execute malicious code during installation.
• Package uses simple pre-prepared tools to create a low-quality malicious action.