Hostile 100% python Download

donutautosellsrc 0.3.7

Downloads and executes hidden payload

“Automated source-distribution and build utilities for donut payload packaging”

Stage-2 retrieved then executedMulti-stage payload delivery (any form)
SHA-2560f50d2a7270eba350fe63156c6062fa0bcab9d41b1c6782dc109d4194c0b4e6a
URLhttps://files.pythonhosted.org/packages/7e/3f/41ff5bd974363019f6663eef3950ad7550cbf85fe59c5b094734944265ea/donutautosellsrc-0.3.7.tar.gz
MaleculeK(Te)O₄(CAsPrS)H₅(Cm₆Db₆F₂Os₂Po₅)Md₄(BkIn₇Pa₄)

Also flagged by osm (During installation package fetches code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data an…), osv (MAL-2026-17192: Malicious code in donutautosellsrc (PyPI)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.