minecraftaccfinder (PyPI) · Malicious Code
Affects minecraftaccfinderSource GCVE Database
Malicious package : remove minecraftaccfinder and rotate any secrets on hosts that installed it.
Data as of 29 Oct 2026, 14:06 UTC
Malicious package
Published to PyPI · OSV MAL-2026-17809
What to do
Remove minecraftaccfinder from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIminecraftaccfinder | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The minecraftaccfinder package published on PyPI in multiple versions was a malicious package designed to steal credentials and session data from the victim's machine. It exfiltrated browser-stored logins and session cookies, collected the machine's public IP address and account identifiers, and sent this data to a hard-coded webhook. The package also installed persistent malware including a remote access trojan (RAT), keylogger, screenshot capture, and credential theft targeting multiple services such as Gmail, Roblox, Discord, and Minecraft. The package has been removed from PyPI.