MalwarePublished 1 May 2026

graphicsctxr (PyPI) · Malicious Code

Affects graphicsctxrSource GCVE Database

Malicious package : remove graphicsctxr and rotate any secrets on hosts that installed it.

Data as of 27 Oct 2026, 00:43 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-3210

What to do

Remove graphicsctxr from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIgraphicsctxr	Affected 1.0.1 – 2.2.3 8 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The graphicsctxr package on PyPI contains malicious code that exfiltrates .env files to a remote target. Versions prior to 2.1.1 also embed a hardcoded SSH key to create a persistent backdoor. The malicious behavior activates when the package is run as a module. This package is part of a campaign with clear malicious intent, including backdoor installation and file exfiltration.

Impact

The malicious code compromises confidentiality by exfiltrating sensitive environment variables (.env files) which may contain secrets such as API keys and credentials. The embedded hardcoded SSH key in versions before 2.1.1 allows persistent unauthorized access, posing a severe security risk. This can lead to further compromise of affected systems and data breaches.

Defensive guidance

Users should avoid using the affected versions of the graphicsctxr package. Remove any installations of these versions and replace them with trusted alternatives. Monitor for any unauthorized SSH keys and investigate for potential backdoors if these versions were used. Since this is a malicious package, refrain from executing it as a module.

Summary

The graphicsctxr package includes intentionally malicious code designed to steal environment files (.env) by sending them to a remote server. Additionally, versions before 2.1.1 embed a hardcoded SSH key, establishing a persistent backdoor for unauthorized access. The malicious actions trigger when the package is executed as a module. This threat is associated with a campaign identified as 2026-04-renderctx, which involves backdoor creation, file exfiltration, and crypto-related malicious activity. The malicious code is deliberately included as a dependency within the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 27 Oct 2026, 00:43 UTC

Technical details

References

Community reviews