Suspicious 80% python Download

donutpromotion 0.1.0

Executes remote signed payload

“Rank and promotion helpers for Minecraft SMP donation scripts”

Source references XOR syntaxunittest TestCase cleanup context
SHA-256c73ed2bc920c266feafba282e7554a0b13de9d453d20ca5eb309f89218744150
URLhttps://files.pythonhosted.org/packages/4c/bd/8ee08e145695d07ff8234c066f416fcc0ebcd867a92051759b8c6fd79a90/donutpromotion-0.1.0.tar.gz
MaleculeO₃(As₂CS)H₆(Cm₄Cr₄Db₁₁F₃OsPo)Md₄(BkIn₆Pa₇)

Also flagged by osv (MAL-2026-17196: Malicious code in donutpromotion (PyPI)) +4 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.