fromthehotel-poems (PyPI) · Malicious Code
Affects fromthehotel-poemsSource GCVE Database
Malicious package : remove fromthehotel-poems and rotate any secrets on hosts that installed it.
Data as of 29 Oct 2026, 14:06 UTC
Malicious package
Published to PyPI · OSV MAL-2026-17897
What to do
Remove fromthehotel-poems from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIfromthehotel-poems | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The fromthehotel-poems PyPI package version 0.1.0 includes a function getdaily() that fetches and executes remote Python code from an external server without verification. This allows whoever controls the server or can tamper with the response to execute arbitrary code with the full privileges of the calling process. The package is identified as malicious, with intent to exploit large language model agents by hiding remote code execution within its API.