MalwarePublished 21 Oct 2026Updated 29 Oct 2026

libseal (PyPI) · Malicious Code

Affects libsealSource GCVE Database

Malicious package : remove libseal and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:08 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-18132

What to do

Remove libseal from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIlibseal	Affected 1.1.0 – 1.1.3 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The libseal package on PyPI, versions 1.1.0 through 1.1.3, is involved in a malicious campaign where it provides decryption algorithms for an encrypted payload delivered by another package, iterquarry. Earlier versions contained an embedded key and communicated with a Discord bot, but recent versions removed the embedded key, leaving the payload unknown. Static analysis found no installer-side harmful behaviors in libseal itself, but the campaign is classified as malicious due to obfuscation and hidden malicious code within dependencies.

Impact

The campaign is malicious and designed to deliver and execute hidden payloads via dependencies, potentially enabling unauthorized code execution or data exfiltration. Although libseal itself shows no direct harmful behavior during installation, its role in decrypting and executing payloads makes it a component of a malware delivery chain. The removal of the embedded key in newer iterquarry versions obscures the payload, increasing uncertainty about the threat's full impact.

Defensive guidance

No official patches or fixes are indicated for libseal. Users should avoid using the affected versions of libseal (1.1.0 to 1.1.3) and the iterquarry package involved in this campaign. Since no direct installer-side harm was detected in libseal, mitigation focuses on removing or blocking these packages from development and deployment environments. Monitoring for and removing these packages from dependency trees is recommended.

Summary

The libseal package versions 1.1.0 to 1.1.3 are part of a malware campaign where libseal acts as a decryption tool for an encrypted payload delivered by the iterquarry package. Initial versions of iterquarry used an embedded key and contacted a Discord bot, but from iterquarry 2.2.0 onward, the key is no longer embedded, and the payload's nature is unknown. Static scanning of libseal showed no direct installer-side malicious behavior such as network I/O or credential theft, but the campaign's intent is malicious, leveraging obfuscation and hiding actions within dependencies.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:08 UTC

Technical details

References

Community reviews