MalwarePublished 25 Jun 2026

extra-huggingface (PyPI) · Malicious Code

Affects extra-huggingfaceSource GCVE Database

Malicious package : remove extra-huggingface and rotate any secrets on hosts that installed it.

Data as of 26 Jun 2026, 22:36 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-6489

What to do

Remove extra-huggingface from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIextra-huggingface	Affected =0.4.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The extra-huggingface package on PyPI is a malicious typosquatting package impersonating the Hugging Face ecosystem. It contains a remote access trojan (RAT) implemented via a large native Windows binary that connects to an attacker-controlled server to receive and execute commands. The package installs persistence mechanisms to survive system reboots and exfiltrates sensitive data, including browser information. It masquerades as an educational tool but is designed for malicious purposes such as data theft and unauthorized remote control.

Impact

Systems that install and run this package are compromised by a remote access trojan that allows attackers to execute arbitrary commands remotely. The malware establishes persistence to survive reboots and exfiltrates sensitive user data, including browser information. This leads to unauthorized data disclosure and full remote control of the affected machine.

Defensive guidance

The recommended mitigation is to avoid installing the extra-huggingface package, especially from untrusted sources. Users should verify package authenticity before installation and remove any instances of this package if found. Security teams should monitor for and block connections to the hardcoded malicious server IP 91.92.40.212. Since this is a malicious typosquat, educating users about typosquatting risks and verifying package names is critical.

Summary

The extra-huggingface PyPI package (version 0.4.0) is a malicious package that impersonates the Hugging Face ecosystem to lure machine learning developers. It includes a native Windows PE module (_native.pyd) that implements a remote access trojan (RAT). The Python code acts as a thin wrapper exposing functions to run the agent, install persistence, and communicate with a hardcoded attacker-controlled server at 91.92.40.212:8080. The agent polls this server to receive commands and maintains persistence by registering itself to run after login or boot. The package exfiltrates sensitive data, including browser data, and is classified as a malicious campaign involving typosquatting, native extensions, persistence, and infostealing.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Jun 2026, 22:36 UTC

Technical details

References

Community reviews