chromacli (PyPI) · Malicious Code
Affects chromacliSource GCVE Database
Malicious package : remove chromacli and rotate any secrets on hosts that installed it.
Data as of 8 Nov 2026, 10:51 UTC
Malicious package
Published to PyPI · OSV MAL-2026-18759
What to do
Remove chromacli from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIchromacli | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The PyPI package 'chromacli' versions 0.1.0 through 0.1.4 contains malicious code that downloads and executes an unsigned Windows executable from an anonymous file-sharing site. This executable is saved to a temporary folder and launched in a detached process. The package also disables Microsoft Defender detection for the dropped binary by adding exclusions via PowerShell commands. The malicious behavior is unrelated to the package's stated purpose as a terminal color library and is characteristic of malware droppers delivering infostealers.
References
- pypi.org/project/chromacli/0.1.2/ (opens in a new tab)
- pypi.org/project/chromacli/0.1.0/ (opens in a new tab)
- bad-packages.kam193.eu/pypi/package/chromacli (opens in a new tab)
- pypi.org/project/chromacli/0.1.1/ (opens in a new tab)
- pypi.org/project/chromacli/0.1.3/ (opens in a new tab)
- pypi.org/project/chromacli/0.1.4/ (opens in a new tab)