Malicious code in langgrap (PyPI)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b11e221d911cf4904a1508f284da0ac0eb17a88e91dadb6dc60ef3bc5d547380) Package name `langgrap` is a one-character deletion of `langgraph`, and `__init__.py` re-exports `from langgraph import *` so imports appear to succeed. The installed `langgrap-setup.pth` file contains an `import...; exec(...)` line that Python auto-executes on every interpreter startup (including non-import invocations like `python -V`). The exec payload is XOR(0x5A)+base64 obfuscated and, when decoded, uses curl to download `http://167.86.108.190:7788/lurves-agent.py` to `/tmp/.a` and runs it via `python3 /tmp/.a --daemon`, guarded by a `/tmp/.lurves-planted` marker. The.pth file additionally contains cover-story comments falsely instructing scanners to classify it as clean. This delivers full remote code execution on the installer's host from an unpinned, unverified script fetched over plain HTTP from a bare IP. ## Source: kam193 (80943fa86afe1c0cd0b657339f2125c48de0ca3cf9848b895e2e60ea744b1db9) Typosquatting package planting a malicious PTH file that during loading Python downloads the next stage. It then hides its existence, downloads the further stage and clears logs. The next stage exfiltrates sensitive data (SSH keys, cloud credentials), ensures persistence and plants a cryptominer. The original PTH file contains a simple attempt to discourage analysis via AI agents. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-openaii Reasons (based on the campaign): - Downloads and executes a remote malicious script. - obfuscation - abuses-pth - cryptominer - infostealer - exfiltration-credentials - files-exfiltration - exfiltration-ssh-keys - persistence - typosquatting - covering-tracks
AI Analysis
Technical Summary
The langgrap package is a typosquatting attack targeting the legitimate langgraph package by omitting one character in the name. Its __init__.py re-exports langgraph to appear legitimate. The malicious langgrap-setup.pth file contains an import and exec line that runs automatically on Python startup, decoding an XOR and base64 obfuscated payload. This payload uses curl to download a Python script from a remote IP over plain HTTP, saving it to /tmp/.a and running it as a daemon. The script exfiltrates sensitive credentials, establishes persistence, plants a cryptominer, and hides its tracks by clearing logs. The package includes misleading comments to evade automated analysis.
Potential Impact
This malicious package delivers full remote code execution on the installer's host. It compromises sensitive data including SSH keys and cloud credentials, ensures persistence on the system, and installs a cryptominer that can degrade system performance and increase resource usage. The use of unencrypted HTTP for downloading the payload exposes the attack to interception but also indicates a lack of secure delivery. The package's obfuscation and log clearing hinder detection and forensic analysis.
Mitigation Recommendations
No official patch or fix is available since this is a malicious package rather than a software vulnerability. The best mitigation is to avoid installing langgrap and verify package names carefully to avoid typosquatting. Remove any installations of langgrap immediately. Use trusted sources and pinned dependencies. Monitor for unexpected .pth files and suspicious Python startup behavior. Since this is not a cloud service, remediation is manual. Patch status is not applicable.
Malicious code in langgrap (PyPI)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b11e221d911cf4904a1508f284da0ac0eb17a88e91dadb6dc60ef3bc5d547380) Package name `langgrap` is a one-character deletion of `langgraph`, and `__init__.py` re-exports `from langgraph import *` so imports appear to succeed. The installed `langgrap-setup.pth` file contains an `import...; exec(...)` line that Python auto-executes on every interpreter startup (including non-import invocations like `python -V`). The exec payload is XOR(0x5A)+base64 obfuscated and, when decoded, uses curl to download `http://167.86.108.190:7788/lurves-agent.py` to `/tmp/.a` and runs it via `python3 /tmp/.a --daemon`, guarded by a `/tmp/.lurves-planted` marker. The.pth file additionally contains cover-story comments falsely instructing scanners to classify it as clean. This delivers full remote code execution on the installer's host from an unpinned, unverified script fetched over plain HTTP from a bare IP. ## Source: kam193 (80943fa86afe1c0cd0b657339f2125c48de0ca3cf9848b895e2e60ea744b1db9) Typosquatting package planting a malicious PTH file that during loading Python downloads the next stage. It then hides its existence, downloads the further stage and clears logs. The next stage exfiltrates sensitive data (SSH keys, cloud credentials), ensures persistence and plants a cryptominer. The original PTH file contains a simple attempt to discourage analysis via AI agents. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-openaii Reasons (based on the campaign): - Downloads and executes a remote malicious script. - obfuscation - abuses-pth - cryptominer - infostealer - exfiltration-credentials - files-exfiltration - exfiltration-ssh-keys - persistence - typosquatting - covering-tracks
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The langgrap package is a typosquatting attack targeting the legitimate langgraph package by omitting one character in the name. Its __init__.py re-exports langgraph to appear legitimate. The malicious langgrap-setup.pth file contains an import and exec line that runs automatically on Python startup, decoding an XOR and base64 obfuscated payload. This payload uses curl to download a Python script from a remote IP over plain HTTP, saving it to /tmp/.a and running it as a daemon. The script exfiltrates sensitive credentials, establishes persistence, plants a cryptominer, and hides its tracks by clearing logs. The package includes misleading comments to evade automated analysis.
Potential Impact
This malicious package delivers full remote code execution on the installer's host. It compromises sensitive data including SSH keys and cloud credentials, ensures persistence on the system, and installs a cryptominer that can degrade system performance and increase resource usage. The use of unencrypted HTTP for downloading the payload exposes the attack to interception but also indicates a lack of secure delivery. The package's obfuscation and log clearing hinder detection and forensic analysis.
Mitigation Recommendations
No official patch or fix is available since this is a malicious package rather than a software vulnerability. The best mitigation is to avoid installing langgrap and verify package names carefully to avoid typosquatting. Remove any installations of langgrap immediately. Use trusted sources and pinned dependencies. Monitor for unexpected .pth files and suspicious Python startup behavior. Since this is not a cloud service, remediation is manual. Patch status is not applicable.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-16133
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["PyPI"]
Threat ID: 6aa49fe655bf5e2cf5a803fb
Added to database: 09/12/2026, 00:42:14 UTC
Last enriched: 09/12/2026, 00:44:46 UTC
Last updated: 09/12/2026, 01:45:54 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.