Malicious code in easyllmai (PyPI)

---

__

Source: amazon-inspector (4589bbb71e0bb3589a162bf2102bba5e8bf7124d3988235647d1e3c1d01821d0)

During pip install, setup.py performs an unauthenticated HTTP fetch of https://pastebin.com/raw/yBcUM1QB, takes the first line of the response, and passes it directly to os.system(f'cmd /c "{cmd_pastebin}"'). The remote content is hosted on an anonymous, mutable, attacker-controlled paste with no pinning, no hash check, and no signature verification. Whoever controls the paste obtains arbitrary command execution on every installer's machine at install time. This is a canonical install-time dropper pattern: lifecycle-time outbound fetch from an unverified source piped straight into the OS shell.

Source: kam193 (b7ac8db348471011dee14fad41b2d0a487f08463c10c678625fe8184e8088e0a)

During installation, the code attempts to download and start a malicious executable.

Likely related to 2025-08-raknet-testing-package.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-easyaillm

Reasons (based on the campaign):

• Downloads and executes a remote executable.

• obfuscation

• malware