Malicious code in bytekit (PyPI)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0bbaea22b635a4a8425964572b733b806f45714a9090492d1c39d545088fe336) The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: kam193 (f4594bf7abce5a96c971ecc42fc52eec534a545cfc614c1b8f3b8d18ca02dd9d) The campaign consists of multiple packages. The trigger sits in the package 'procwire,' which depends on two others. During installation, procwire uses schemavault and bytekit packages. The first one holds the URL holding malware (in two places, once as steganography in the bundled image and once as a fallback just as a list of encoded bytes). The bytekit implements simple custom decoding used to retrieve back the URL in the fallback method. Additionally, procwire is also a dependency of confighub, turning another package into malware. The downloaded executable is run and quickly removed. The executable likely contains an infostealer and contacts the domain 030502[.]xyz --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-procwire Reasons (based on the campaign): - The package overrides the install command in setup.py to execute malicious code during installation. - Downloads and executes a remote executable. - obfuscation - The malicious code is intentionally included in a dependency of the package - malware - steganography
AI Analysis
Technical Summary
The malicious campaign '2026-07-procwire' involves multiple PyPI packages, including 'procwire', 'schemavault', and 'bytekit'. The 'procwire' package overrides the install command in setup.py to execute malicious code during installation. It uses 'schemavault' and 'bytekit' to decode and retrieve a URL hidden via steganography and encoded bytes. This URL points to a remote executable that is downloaded, executed, and then deleted. The executable likely functions as an infostealer and communicates with the domain 030502[.]xyz. The 'bytekit' package (versions 3.4.1 and 3.4.2) implements the decoding mechanism used in this process, making it part of the malicious supply chain.
Potential Impact
Installation of the affected 'bytekit' versions as part of the malicious dependency chain results in execution of a remote payload that likely steals information. The malicious executable runs on the victim's system and contacts an attacker-controlled domain, potentially compromising system confidentiality and integrity. The use of obfuscation and steganography complicates detection and analysis.
Mitigation Recommendations
No official patch or fix is currently available for the affected 'bytekit' versions 3.4.1 and 3.4.2. Users should avoid installing these versions and any packages depending on 'procwire' or 'confighub' until the issue is resolved. Monitor vendor advisories for updates. Since this is a malicious package campaign, removing the affected packages and scanning for indicators of compromise is recommended.
Malicious code in bytekit (PyPI)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0bbaea22b635a4a8425964572b733b806f45714a9090492d1c39d545088fe336) The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: kam193 (f4594bf7abce5a96c971ecc42fc52eec534a545cfc614c1b8f3b8d18ca02dd9d) The campaign consists of multiple packages. The trigger sits in the package 'procwire,' which depends on two others. During installation, procwire uses schemavault and bytekit packages. The first one holds the URL holding malware (in two places, once as steganography in the bundled image and once as a fallback just as a list of encoded bytes). The bytekit implements simple custom decoding used to retrieve back the URL in the fallback method. Additionally, procwire is also a dependency of confighub, turning another package into malware. The downloaded executable is run and quickly removed. The executable likely contains an infostealer and contacts the domain 030502[.]xyz --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-procwire Reasons (based on the campaign): - The package overrides the install command in setup.py to execute malicious code during installation. - Downloads and executes a remote executable. - obfuscation - The malicious code is intentionally included in a dependency of the package - malware - steganography
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The malicious campaign '2026-07-procwire' involves multiple PyPI packages, including 'procwire', 'schemavault', and 'bytekit'. The 'procwire' package overrides the install command in setup.py to execute malicious code during installation. It uses 'schemavault' and 'bytekit' to decode and retrieve a URL hidden via steganography and encoded bytes. This URL points to a remote executable that is downloaded, executed, and then deleted. The executable likely functions as an infostealer and communicates with the domain 030502[.]xyz. The 'bytekit' package (versions 3.4.1 and 3.4.2) implements the decoding mechanism used in this process, making it part of the malicious supply chain.
Potential Impact
Installation of the affected 'bytekit' versions as part of the malicious dependency chain results in execution of a remote payload that likely steals information. The malicious executable runs on the victim's system and contacts an attacker-controlled domain, potentially compromising system confidentiality and integrity. The use of obfuscation and steganography complicates detection and analysis.
Mitigation Recommendations
No official patch or fix is currently available for the affected 'bytekit' versions 3.4.1 and 3.4.2. Users should avoid installing these versions and any packages depending on 'procwire' or 'confighub' until the issue is resolved. Monitor vendor advisories for updates. Since this is a malicious package campaign, removing the affected packages and scanning for indicators of compromise is recommended.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6751
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a498a8127e9c7971936fdc6
Added to database: 07/04/2026, 22:34:41 UTC
Last enriched: 07/04/2026, 22:40:02 UTC
Last updated: 07/31/2026, 05:59:40 UTC
Views: 116
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.