{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "grokwrapper"
      },
      "versions": [
        "0.1.0",
        "0.2.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)",
      "type": "REPORTER"
    }
  ],
  "database_specific": {
    "iocs": {
      "urls": [
        "https://dl.dropboxusercontent.com/scl/fi/su8ks7znqh6lzkd9n26yt/PenisKOZLA.gif?rlkey=6otsosk8q7bjv2z44i16bmblo\u0026st=ehtbhkv8\u0026dl=1"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "pypi/2026-02-grokwrapper/grokwrapper",
        "import_time": "2026-02-08T10:44:49.658863606Z",
        "modified_time": "2026-02-08T10:34:16.102765Z",
        "sha256": "a7ae896464be7f195243e35231a2435d0a1eb055cc7fa8cfaef707c7e11c55b2",
        "source": "kam193",
        "versions": [
          "0.1.0",
          "0.2.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (a7ae896464be7f195243e35231a2435d0a1eb055cc7fa8cfaef707c7e11c55b2)\nDuring importing the module, package silently execute code hidden in an embedded config file, and downloads remote executable. It\u0027s then added to Run registry key for persistence and started.\n\nDuring analysis, the executable was not detected by antiviruses.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-02-grokwrapper\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - peristence-autorun\n",
  "id": "MAL-2026-811",
  "modified": "2026-02-08T10:34:16Z",
  "published": "2026-02-08T10:34:16Z",
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://www.virustotal.com/gui/file/1963f8777e33d95c106ba28857058348eed021b4b86c46bad63b63dabada26ce/summary"
    },
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/grokwrapper"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in grokwrapper (PyPI)"
}