MalwarePublished 12 Nov 2026

dashloom (PyPI) · Malicious Code

Affects dashloomSource GCVE Database

Malicious package : remove dashloom and rotate any secrets on hosts that installed it.

Data as of 13 Nov 2026, 03:13 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-19202

What to do

Remove dashloom from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIdashloom	Affected =1.0.0 =1.1.0 =1.1.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The dashloom package on PyPI is identified as malicious software designed to load and execute remote malicious code. It uses a vulnerable pinned version of the pydash dependency to execute code outside the intended scope via the pydash.invoke function. The malicious code is delivered from a now-benign GitHub file and executed in an encrypted form when triggered with specific arguments. This package was flagged by PyPI Security and is confirmed to have clear malicious intent.

Impact

The package enables execution of remote malicious code by exploiting a vulnerable dependency, potentially allowing attackers to run arbitrary code on systems that install dashloom. This can lead to compromise of the affected environment, data theft, or further malicious activity. The malicious code execution is triggered through crafted inputs and remote script downloads, posing a significant security risk to users of the affected versions.

Defensive guidance

Users should immediately uninstall the dashloom package if present. Avoid installing or using dashloom versions 1.0.0, 1.1.0, and 1.1.1. Since this is a malicious package flagged by PyPI Security, no legitimate patch or fix exists; the best mitigation is to remove the package and avoid its use. Monitor for any unauthorized installations of this package in your environment.

Summary

Dashloom is a malicious PyPI package that acts as a loader for executing remote malicious scripts. It relies on a vulnerable version of the pydash library, specifically exploiting the pydash.invoke function to escape object scope and execute arbitrary code. The malicious payload is delivered through a GitHub file, which is split and passed to the vulnerable function for execution. The same GitHub user account also maintains a repository that executes embedded encrypted code under certain conditions. This package was flagged by PyPI Security for its malicious behavior and is categorized as malware with clear intent to execute harmful actions.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Nov 2026, 03:13 UTC

Technical details

References

Community reviews