Suspicious 80% python Download

donutautosellsrc 0.3.9

Downloads and executes hidden payload

“Automated source-distribution and build utilities for donut payload packaging”

setuptools packageRoot Python setup.py packaging file
SHA-2561313f052071e261fa12d70ad1fcc8ac9bae010adfa0d3bd477e21bbe2ee1f7f5
URLhttps://files.pythonhosted.org/packages/ba/f1/762bb5f50feb84bedfdb3596aa6641f92dc9b124c43818a4171e912d0e96/donutautosellsrc-0.3.9.tar.gz
MaleculeK(Te)O₄(As₂CPrS)H₆(Cm₇Db₈F₂Os₂Po₄U)Md₄(Bk₂In₉Pa₅)

Also flagged by osm (During installation package fetches code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data an…), osv (MAL-2026-17192: Malicious code in donutautosellsrc (PyPI)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.