THREATPKG
SYNC STALE
Supply-chain threat intelligence
Incident detail
Risk score
92
AI summary
Indexed incident for imgmatrix-analysis (pypi).
Description
During import, the package executes remote commands sourced from a Google Sheet.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-imgmatrix-analysis
Reasons (based on the campaign):
- The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
Technical details
Indicators
- affected version<function fixed() { [native code] }75%
- affected version<function fixed() { [native code] }75%
- affected version<function fixed() { [native code] }75%
- affected version<function fixed() { [native code] }75%
- affected version<function fixed() { [native code] }75%
- affected version<function fixed() { [native code] }75%
- affected version<function fixed() { [native code] }75%
- affected version<function fixed() { [native code] }75%
- affected version<function fixed() { [native code] }75%
- affected version<function fixed() { [native code] }75%
Timeline
- Advisory published
- Indexed by ThreatPkg