MalwarePublished 27 Sep 2026Updated 25 Oct 2026

aseity (PyPI) · Malicious Code

Affects aseitySource GCVE Database

Malicious package : remove aseity and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:22 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-17200

What to do

Remove aseity from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIaseity	Affected =0.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The aseity package on PyPI version 0.1.0 contains malicious code that executes automatically during installation and import. It uses obfuscated and encoded payloads to deploy a multi-stage malware dropper that downloads additional components from a suspicious domain. The malware performs VM and debugger checks, extracts and runs a hidden Python executable, and includes an infostealer that exfiltrates data to a command-and-control server referenced via blockchain transactions. The package employs steganography and native extensions to evade detection and persist on the infected host.

Impact

This malicious package can compromise the security of any system where it is installed or imported by executing arbitrary code, deploying a persistent second-stage implant, and stealing sensitive information. The infostealer component exfiltrates data to an attacker-controlled server, potentially leading to data breaches and further compromise. The use of sandbox and VM detection techniques may hinder analysis and detection by security tools.

Defensive guidance

Users and organizations should avoid installing or importing the aseity package version 0.1.0 from PyPI. Remove any existing installations of this package and conduct forensic analysis on affected systems to detect and remediate the second-stage payload. Monitor for suspicious network activity related to the described domain and blockchain-based command-and-control communications. Check vendor advisories or PyPI security notices for updates on remediation.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Sep 2026, 04:46 UTC

Technical details

References

Community reviews