numpyp (PyPI) · Malicious Code
Affects numpypSource GCVE Database
Malicious package : remove numpyp and rotate any secrets on hosts that installed it.
Data as of 5 Aug 2026, 17:21 UTC
Malicious package
Published to PyPI · OSV MAL-2026-12503
What to do
Remove numpyp from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPInumpyp | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The PyPI package 'numpyp' is a malicious typo-squatting package mimicking the popular 'numpy' library. It exports functions that send any input data provided by the user to a hardcoded external server controlled by the attacker without disclosure. This can lead to inadvertent leakage of sensitive information such as secrets or proprietary data if a developer mistakenly installs and uses 'numpyp' instead of 'numpy'.