ln9qw38745g (PyPI) · Malicious Code
Affects ln9qw38745gSource GCVE Database
Malicious package : remove ln9qw38745g and rotate any secrets on hosts that installed it.
Data as of 4 Nov 2026, 00:45 UTC
Malicious package
Published to PyPI · OSV MAL-2026-18583
What to do
Remove ln9qw38745g from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIln9qw38745g | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The PyPI package 'ln9qw38745g' versions 0.1.0 and 0.1.1 contain embedded malicious code. This package overrides the installation process to execute malware, specifically a remote access trojan (RAT), during setup. It is linked to a prior package that switched from benign to malicious executables after a few releases.
References
- virustotal.com/gui/file/e5a585e03e1725d5030fd4854805933d53aa86cfbbb0b3808dffcc63782ddf38/detection (opens in a new tab)
- virustotal.com/gui/file/1a89eb45ed45780f16499b0f87ff3dd17db4be0988f7befbfa88224d83fccae2/detection (opens in a new tab)
- tria.ge/261103-xxcp9aez3r (opens in a new tab)
- virustotal.com/gui/file/c8ecde6b3840ab32ceace277f7fd1bfc63eb87344ab9147651e3c4c11dbbac93/detection (opens in a new tab)
- virustotal.com/gui/file/f511eff8b0cec4854856e3686a3eded0decf5fa3b04d585f9f2e951b7d13c295/detection (opens in a new tab)
- bad-packages.kam193.eu/pypi/package/ln9qw38745g (opens in a new tab)