axiom-dragon-xyz (PyPI) · Malicious Code
Affects axiom-dragon-xyzSource GCVE Database
Malicious package : remove axiom-dragon-xyz and rotate any secrets on hosts that installed it.
Data as of 13 Nov 2026, 23:32 UTC
Malicious package
Published to PyPI · OSV MAL-2026-19289
What to do
Remove axiom-dragon-xyz from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIaxiom-dragon-xyz | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (7bb0be864a1e4a0a1e01ae4fa900052bf2f74c57f9d7ed40b4fae48caa84e746) During installation package exfiltrates sensitive files used by cryptocurrency wallets and storing cloud credentials. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-11-axiom-dragon-xyz Reasons (based on the campaign): - infostealer - The package overrides the install command in setup.py to execute malicious code during installation. - exfiltration-crypto - exfiltration-credentials - obfuscation