Malicious code in claudedashbord (PyPI)
The claudedashbord package on PyPI contains malicious code that executes automatically on every Python interpreter startup via a .pth file. It fetches and executes remote code from a hardcoded non-publisher endpoint, enabling arbitrary code execution on the victim's machine. The malware includes anti-analysis features to evade sandbox detection and delays execution to avoid dynamic analysis. Additionally, obfuscated code and a native extension module act as an infostealer, exfiltrating sensitive data to a command-and-control server whose address is derived from blockchain transaction history. The package versions 0.1.0 through 0.1.3 are affected.
AI Analysis
Technical Summary
The claudedashbord PyPI package installs a .pth file that CPython auto-executes on interpreter startup, importing telemetry.check() which performs an HTTPS GET to a hardcoded external URL. The response is verified and then executed, allowing remote arbitrary code execution. Execution is gated by checks for real user environments and timing delays to evade sandbox and dynamic analysis. The package also contains obfuscated code that fetches a Python application with a native extension module embedding an infostealer. This infostealer collects sensitive data and exfiltrates it to a command-and-control server address derived from Polygon blockchain transaction history. The package name mimics 'Claude dashboard' as a lure. Versions 0.1.0, 0.1.1, 0.1.2, and 0.1.3 are confirmed affected.
Potential Impact
This malicious package enables persistent arbitrary code execution on any Python invocation after installation, compromising the host system. It also steals sensitive information via a native extension infostealer and exfiltrates data to a blockchain-based command-and-control server. The anti-analysis features reduce detection likelihood, increasing the risk of prolonged undetected compromise.
Mitigation Recommendations
No official patch or remediation is indicated in the provided data. Users should immediately uninstall the claudedashbord package versions 0.1.0 through 0.1.3 if installed. Avoid installing packages from untrusted sources or with suspicious names. Monitor for unexpected Python startup behaviors and network connections to unknown endpoints. Check vendor advisories or PyPI for updates or removal notices regarding this package.
Malicious code in claudedashbord (PyPI)
Description
The claudedashbord package on PyPI contains malicious code that executes automatically on every Python interpreter startup via a .pth file. It fetches and executes remote code from a hardcoded non-publisher endpoint, enabling arbitrary code execution on the victim's machine. The malware includes anti-analysis features to evade sandbox detection and delays execution to avoid dynamic analysis. Additionally, obfuscated code and a native extension module act as an infostealer, exfiltrating sensitive data to a command-and-control server whose address is derived from blockchain transaction history. The package versions 0.1.0 through 0.1.3 are affected.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The claudedashbord PyPI package installs a .pth file that CPython auto-executes on interpreter startup, importing telemetry.check() which performs an HTTPS GET to a hardcoded external URL. The response is verified and then executed, allowing remote arbitrary code execution. Execution is gated by checks for real user environments and timing delays to evade sandbox and dynamic analysis. The package also contains obfuscated code that fetches a Python application with a native extension module embedding an infostealer. This infostealer collects sensitive data and exfiltrates it to a command-and-control server address derived from Polygon blockchain transaction history. The package name mimics 'Claude dashboard' as a lure. Versions 0.1.0, 0.1.1, 0.1.2, and 0.1.3 are confirmed affected.
Potential Impact
This malicious package enables persistent arbitrary code execution on any Python invocation after installation, compromising the host system. It also steals sensitive information via a native extension infostealer and exfiltrates data to a blockchain-based command-and-control server. The anti-analysis features reduce detection likelihood, increasing the risk of prolonged undetected compromise.
Defensive Guidance
No official patch or remediation is indicated in the provided data. Users should immediately uninstall the claudedashbord package versions 0.1.0 through 0.1.3 if installed. Avoid installing packages from untrusted sources or with suspicious names. Monitor for unexpected Python startup behaviors and network connections to unknown endpoints. Check vendor advisories or PyPI for updates or removal notices regarding this package.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-17195
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["PyPI"]
Threat ID: 6abb4186f7a7c54106cc2f71
Added to database: 09/29/2026, 04:41:42 UTC
Last enriched: 09/29/2026, 04:46:35 UTC
Last updated: 09/29/2026, 18:13:14 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.