decapod-common (PyPI) · Malicious Code
Affects decapod-commonSource GCVE Database
Malicious package : remove decapod-common and rotate any secrets on hosts that installed it.
Data as of 6 Aug 2026, 18:37 UTC
Malicious package
Published to PyPI · OSV MAL-2026-13386
What to do
Remove decapod-common from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIdecapod-common | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The decapod-common package on PyPI contains malicious code that exfiltrates the installer's hostname and resolved IP address to a hardcoded external webhook during installation. This behavior occurs automatically during the pip install process via an overridden install command in setup.py. The package does not provide any legitimate functionality beyond this data exfiltration.