MalwarePublished 21 Oct 2026Updated 29 Oct 2026

brummatts (PyPI) · Malicious Code

Affects brummattsSource GCVE Database

Malicious package : remove brummatts and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 17:52 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-18136

What to do

Remove brummatts from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIbrummatts	Affected =0.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The brummatts 0.1.0 PyPI package is part of a malicious campaign involving loader packages designed to execute code from remote URLs. Although the package itself does not contain direct credential access, outbound network I/O to attacker-controlled destinations, or install-time fetch-and-execute behavior, it serves as a mechanism to load and execute malicious scripts remotely. This campaign is identified as having clearly malicious intent, such as infostealers.

Impact

The package enables execution of remote malicious scripts, which can lead to the deployment of malware such as infostealers. While the package itself does not directly perform credential theft or network communication to attacker-controlled servers, its capability to load and execute external code poses a significant security risk by potentially delivering harmful payloads.

Defensive guidance

Since this is a malicious package distributed via PyPI, the primary mitigation is to avoid installing or using the brummatts 0.1.0 package. Security teams should block or monitor for this package in their environments and remove any instances if found.

Summary

The brummatts 0.1.0 package on PyPI is associated with a coordinated malicious campaign that uses loader packages to execute code fetched from remote URLs. Analysis of the package's 13 files found no direct evidence of credential theft, backdoors, or self-propagation within the package itself. However, the package's role in downloading and executing remote malicious scripts categorizes it as part of a broader campaign with malicious objectives. The exact usage of the package remains unknown, but it is clearly designed to facilitate remote code execution as part of the campaign '2026-10-voice-synthesis-profiles'.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 17:52 UTC

Technical details

References

Community reviews