aitextutils-py (PyPI) · Malicious Code
Affects aitextutils-pySource GCVE Database
Malicious package : remove aitextutils-py and rotate any secrets on hosts that installed it.
Data as of 23 Sep 2026, 06:23 UTC
Malicious package
Published to PyPI · OSV MAL-2026-16131
What to do
Remove aitextutils-py from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIaitextutils-py | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The Python package aitextutils-py versions 0.1.0 and 0.1.1 contain malicious code or depend on a malicious package. This malicious code downloads and executes heavily obfuscated remote scripts, establishes persistence on the victim system as a systemd service named "anymeetly-cameradriver," and functions as an infostealer and remote access trojan (RAT). The package executes remote commands and exfiltrates browser data. The campaign associated with this threat is identified as 2026-09-aitextkit-py and is classified as critical due to its malicious intent and capabilities.