MalwarePublished 7 Aug 2026

fast-hashes (PyPI) · Malicious Code

Affects fast-hashesSource GCVE Database

Malicious package : remove fast-hashes and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:41 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-13490

What to do

Remove fast-hashes from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIfast-hashes	Affected =0.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The fast-hashes package version 0.1.0 on PyPI contains malicious code that executes during installation. The setup.py file overrides the install command to decode and execute a base64-encoded payload, which downloads and runs an unverified binary from a third-party GitHub repository. This behavior enables arbitrary code execution on the installer's host. The package is a typosquatting attempt mimicking a popular library and is designed to exfiltrate cryptocurrency wallet data and potentially other sensitive information.

Impact

Installation of fast-hashes version 0.1.0 results in arbitrary code execution on the host system with the privileges of the installing user. The malicious payload downloads and executes an unverified binary from a third-party GitHub repository, which exfiltrates cryptocurrency wallet data and possibly other sensitive information. This compromises the confidentiality and integrity of the affected system and user data.

Defensive guidance

Avoid installing the fast-hashes package version 0.1.0 from PyPI. Since this is a malicious typosquatting package, users should verify package names carefully before installation. Remove any installations of this package and scan affected systems for indicators of compromise. Use trusted sources and verify package authenticity before installation.

Summary

The fast-hashes PyPI package version 0.1.0 includes a malicious setup.py script that overrides the installation process. It decodes a base64 payload that downloads an opaque binary from an unrelated GitHub account, saves it to /tmp, sets executable permissions, and launches it detached from the install process. The package itself only wraps hashlib functionality and has no legitimate need for native binaries, indicating the download-and-execute behavior is malicious. This results in arbitrary code execution under the installer's user context and data exfiltration, including cryptocurrency wallet information. The package is a typosquatting campaign designed to trick users into installing it.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 15:41 UTC

Technical details

References

Community reviews