MalwarePublished 7 Aug 2026

fastapii (PyPI) · Malicious Code

Affects fastapiiSource GCVE Database

Malicious package : remove fastapii and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:40 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-13486

What to do

Remove fastapii from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIfastapii	Affected 0.1.1 – 0.3.0 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The fastapii package on PyPI is a malicious typosquatting package impersonating the popular fastapi library. During installation, it executes obfuscated code that downloads and runs a remote binary on Linux systems. This binary is fetched from an unrelated GitHub account without verification, and the package's real behavior is to drop and execute this payload. The payload reportedly exfiltrates cryptocurrency wallet data and potentially other sensitive information. The malicious activity is triggered only on Linux, allowing it to evade detection on other platforms. The package versions 0.1.1, 0.1.2, 0.2.0, and 0.3.0 are affected.

Impact

The malicious package can lead to arbitrary code execution on Linux systems during installation. The downloaded binary can exfiltrate cryptocurrency wallet data and potentially other sensitive information. This compromises the confidentiality and integrity of affected systems and data. Because the payload is executed during installation, it can affect developer environments, CI pipelines, and production Linux servers that inadvertently install this package. The unverified remote fetch increases the risk of supply chain compromise and further malware delivery.

Defensive guidance

Avoid installing the fastapii package or any similarly named typosquatting packages. Use only the official fastapi package from PyPI. Verify package names carefully before installation and consider using package allowlists or automated supply chain security tools to prevent typosquatting attacks.

Summary

fastapii is a malicious PyPI package that uses typosquatting to impersonate the legitimate fastapi package. Its setup.py overrides the install command to run a post-install step that decodes a base64 payload and executes it. On Linux, this payload downloads a binary from an unrelated GitHub repository, saves it to /tmp, makes it executable, and launches it detached. The binary is unverified and unpinned, posing a risk of arbitrary code execution. The package itself contains only a stub module with trivial functionality to obscure its malicious intent. The payload is designed to exfiltrate cryptocurrency wallet data and possibly other sensitive information. This threat is Linux-specific and activates during installation or in Linux CI/production environments.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 15:40 UTC

Technical details

References

Community reviews