MalwarePublished 21 Oct 2026Updated 29 Oct 2026

iterquarry (PyPI) · Malicious Code

Affects iterquarrySource GCVE Database

Malicious package : remove iterquarry and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 14:06 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-18131

What to do

Remove iterquarry from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIiterquarry	Affected 2.1.1 – 2.2.1 6 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The iterquarry Python package (versions 2.1.1 through 2.2.1) is part of a malicious campaign involving obfuscated code execution. It acts as a thin wrapper over a sibling package, libseal, which contains encrypted payloads decrypted and executed at runtime using hardcoded or embedded keys. Earlier versions included a payload that contacted a Discord bot, indicating malicious intent. The package itself does not provide legitimate iterator functionality but instead executes arbitrary encrypted code from its dependency.

Impact

The packages enable execution of arbitrary encrypted code at import time without integrity verification, effectively allowing remote code execution or other malicious actions. Earlier payloads contacted a Discord bot, suggesting potential command and control communication. This compromises the security of any environment where these package versions are installed and imported.

Defensive guidance

No official patches or fixes are documented for these malicious packages. The recommended mitigation is to avoid installing or using iterquarry versions 2.1.1 through 2.2.1 and their dependency libseal. Remove these packages if present and use trusted alternatives. Monitor PyPI and vendor advisories for any updates or removals related to these packages.

Summary

iterquarry versions 2.1.1 to 2.2.1 on PyPI are malicious packages that use a two-part mechanism: iterquarry depends on libseal, which contains encrypted code executed at import time. The decryption uses a hardcoded password in earlier versions, allowing execution of opaque encrypted content with no integrity checks. This design enables arbitrary code execution hidden within the dependency. The campaign is characterized by obfuscation and embedding malicious code in dependencies. Starting with version 2.2.0, the decryption key is no longer embedded, and the payload's behavior is unknown, but the intent remains malicious.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 14:06 UTC

Technical details

References

Community reviews