Malicious code in libasync (PyPI)
The libasync package version 1.0.0 on PyPI contains malicious code that downloads and executes a remote binary used for cryptomining. The malicious code is obfuscated within a native extension and establishes persistence on the infected system via registry keys. It also includes sandbox detection mechanisms to evade analysis. This malicious activity is linked to the campaign named 2026-08-libasync.
AI Analysis
Technical Summary
The libasync PyPI package version 1.0.0 includes obfuscated native extension code that, upon import, downloads a remote executable associated with cryptomining operations. The code establishes persistence through registry keys and attempts to detect sandbox environments to avoid detection. This malicious behavior is part of a broader campaign (2026-08-libasync) with infrastructure linked to the 2026-07-pyqt6darktheme campaign. No CVSS score is available for this threat.
Potential Impact
Systems that install and run libasync version 1.0.0 are at risk of having a remote cryptomining binary downloaded and executed without user consent. The malware establishes persistence on the system, potentially leading to unauthorized resource consumption and system compromise. The sandbox detection capability may hinder detection and analysis efforts.
Mitigation Recommendations
No official patch or remediation guidance is provided. Users should immediately avoid installing or using libasync version 1.0.0 from PyPI. Remove any installations of this package and scan affected systems for the presence of the malicious binary and persistence mechanisms. Monitor for unusual system resource usage indicative of cryptomining activity.
Malicious code in libasync (PyPI)
Description
The libasync package version 1.0.0 on PyPI contains malicious code that downloads and executes a remote binary used for cryptomining. The malicious code is obfuscated within a native extension and establishes persistence on the infected system via registry keys. It also includes sandbox detection mechanisms to evade analysis. This malicious activity is linked to the campaign named 2026-08-libasync.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The libasync PyPI package version 1.0.0 includes obfuscated native extension code that, upon import, downloads a remote executable associated with cryptomining operations. The code establishes persistence through registry keys and attempts to detect sandbox environments to avoid detection. This malicious behavior is part of a broader campaign (2026-08-libasync) with infrastructure linked to the 2026-07-pyqt6darktheme campaign. No CVSS score is available for this threat.
Potential Impact
Systems that install and run libasync version 1.0.0 are at risk of having a remote cryptomining binary downloaded and executed without user consent. The malware establishes persistence on the system, potentially leading to unauthorized resource consumption and system compromise. The sandbox detection capability may hinder detection and analysis efforts.
Mitigation Recommendations
No official patch or remediation guidance is provided. Users should immediately avoid installing or using libasync version 1.0.0 from PyPI. Remove any installations of this package and scan affected systems for the presence of the malicious binary and persistence mechanisms. Monitor for unusual system resource usage indicative of cryptomining activity.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14308
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a870a73acd9273b49b58a9d
Added to database: 08/20/2026, 14:08:51 UTC
Last enriched: 08/20/2026, 14:29:54 UTC
Last updated: 08/20/2026, 20:23:39 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.