MalwarePublished 16 Jul 2026Updated 28 Jul 2026

dde-common (PyPI) · Malicious Code

Affects dde-commonSource GCVE Database

Malicious package : remove dde-common and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:07 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-10757

What to do

Remove dde-common from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIdde-common	Affected =0.0.1 =8.5.3 =8.5.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The PyPI package dde-common is a malicious package that installs a persistent backdoor via a .pth file causing code execution on every Python interpreter start. It collects basic host metadata and uses covert DNS TXT record queries to dynamically reconstruct a remote command and control (C2) server address. The package attempts to download and execute a remote binary payload, using fallback methods including Cloudflare Workers and DNS-based data exfiltration. Versions 0.0.1, 8.5.3, and 8.5.4 are affected. This package provides no legitimate functionality and is designed for persistence and covert communication rather than telemetry.

Impact

This malicious package enables persistent, interpreter-wide execution of unauthorized code on affected hosts. It collects and exfiltrates host metadata and downloads and executes remote binaries, potentially leading to full system compromise. The use of DNS TXT records for covert C2 rendezvous and fallback download methods complicates detection and mitigation. The package abuses Python packaging mechanisms to maintain persistence and evade simple detection. There is no indication of known exploits in the wild yet, but the capability for remote code execution and covert communication represents a high risk.

Defensive guidance

The recommended mitigation is to remove the dde-common package from all environments and ensure no telemetry.pth or _telemetry_init modules remain in site-packages. Avoid installing packages from untrusted sources or with suspicious telemetry behavior. Monitor Python environments for unexpected .pth files and network DNS queries to unusual domains. Since this is not a cloud service, remediation is the responsibility of the user environment. Patch status is not applicable; check vendor or PyPI advisories for updates or takedown notices.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 20 Jul 2026, 19:52 UTC

Technical details

References

Community reviews