infra-libs (PyPI) · Malicious Code
Affects infra-libsSource GCVE Database
Malicious package : remove infra-libs and rotate any secrets on hosts that installed it.
Data as of 8 Nov 2026, 10:51 UTC
Malicious package
Published to PyPI · OSV MAL-2026-18761
What to do
Remove infra-libs from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIinfra-libs | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The PyPI package 'infra-libs' version 99.99.99 performs unauthorized DNS exfiltration of the installer's hostname during installation and import. It constructs DNS queries embedding the hostname to a suspicious external domain unrelated to the publisher, with no legitimate functionality justifying this behavior. This package name is confusable with internal infrastructure libraries, increasing risk of dependency confusion attacks.