MalwarePublished 10 Jun 2026Updated 8 Jul 2026

hello-dynamic (PyPI) · Malicious Code

Affects hello-dynamicSource GCVE Database

Malicious package : remove hello-dynamic and rotate any secrets on hosts that installed it.

Data as of 9 Jul 2026, 09:52 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-5518

What to do

Remove hello-dynamic from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIhello-dynamic	Affected =0.1.0 =0.1.1 =0.1.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The hello-dynamic PyPI package versions 0.1.0, 0.1.1, and 0.1.2 are near-empty packages with minimal functionality but include a setup configuration that points to an external webhook URL. This behavior is consistent with reconnaissance activity to test which installers still process legacy dependency_links entries. The package does not contain code for exfiltration, remote code execution, credential theft, or persistence. It appears to be a low-risk pentest or research artifact rather than an active malicious threat.

Impact

The impact is minimal as modern Python package installers ignore the legacy dependency_links configuration, preventing the webhook callback from being triggered during installation. There is no malicious code execution, data exfiltration, or persistence mechanism present. The package's behavior is limited to reconnaissance to identify vulnerable installers that still process dependency_links. No known exploits in the wild have been reported.

Defensive guidance

Since modern pip versions ignore dependency_links, the risk is minimal. Users should ensure they use up-to-date package installers that do not process legacy dependency_links entries. No additional remediation or patch is required for this package. Avoid installing untrusted or unknown packages from PyPI to reduce exposure to similar reconnaissance or low-risk malicious packages.

Summary

The hello-dynamic package on PyPI (versions 0.1.0, 0.1.1, 0.1.2) is a near-empty package whose setup.cfg declares a dependency_links entry pointing to a webhook.site endpoint, a service used to inspect HTTP callbacks. Modern pip versions ignore dependency_links, so the potential for harm is minimal. The package's structure and metadata suggest it is a reconnaissance probe testing which installers still process dependency_links. There is no evidence of exfiltration, remote code execution, credential access, or persistence mechanisms in the package code. This package is categorized as a probable pentest or research tool with low harm potential.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 9 Jul 2026, 09:52 UTC

Technical details

References

Community reviews