MalwarePublished 12 Jul 2026

fast-dotenv (PyPI) · Malicious Code

Affects fast-dotenvSource GCVE Database

Malicious package : remove fast-dotenv and rotate any secrets on hosts that installed it.

Data as of 13 Jul 2026, 09:52 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-10215

What to do

Remove fast-dotenv from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIfast-dotenv	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The fast-dotenv package version 1.0.0 on PyPI contains malicious code that activates after a 72–96 hour delay. Once activated, it retrieves a remote command-and-control (C2) configuration from obfuscated URLs and exfiltrates system information, including environment variables with sensitive keywords and SSH key files. The malicious code hides its network destinations using base64 encoding and cover comments, indicating a staged supply-chain credential stealer. The embedded C2 URLs did not exist at the time of analysis but are linked to related malicious repositories. No official patch or remediation is currently available.

Impact

The malicious code can exfiltrate sensitive environment variables and enumerate SSH key files, potentially exposing credentials and secrets stored on the affected system. This can lead to credential theft and unauthorized access to systems or services. The delayed activation and obfuscation techniques increase the difficulty of early detection. No known exploits in the wild have been reported yet.

Defensive guidance

Users should immediately remove this package from their environments and avoid using it. Since this is a supply-chain threat, verify dependencies carefully and consider using trusted package sources or internal mirrors. Monitor for any suspicious network activity related to the described C2 patterns.

Summary

The fast-dotenv PyPI package version 1.0.0 includes a delayed-activation malicious payload that, after a randomized 72–96 hour dormancy, fetches a JSON C2 configuration from base64-obfuscated dead-drop URLs. It collects host identity, environment variables containing sensitive keywords (e.g., key, secret, token, password, auth, private, wallet, seed, mnemonic), and enumerates SSH key files in the user's ~/.ssh/ directory. The C2 URLs are concealed within the code as base64 literals with misleading comments to evade detection. Although the analyzed version did not exfiltrate SSH key contents, the overall behavior is consistent with a staged supply-chain credential stealer. The malicious infrastructure is linked to GitHub and GitLab accounts hosting similar code in other languages. The package is classified as malicious with clear intent to steal credentials.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Jul 2026, 09:52 UTC

Technical details

References

Community reviews