MalwarePublished 1 Aug 2026Updated 4 Aug 2026

nvtorch-oot-nightly (PyPI) · Malicious Code

Affects nvtorch-oot-nightlySource GCVE Database

Malicious package : remove nvtorch-oot-nightly and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-11425

What to do

Remove nvtorch-oot-nightly from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPInvtorch-oot-nightly	Affected =99999.0.0 =99999.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (0f81b904b849df393cbe5c34f952af65d8b28e0797e33d62cf964df77d4929c7) Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation.

Impact

The impact is limited to unauthorized exfiltration of basic host information such as IP address and username. There is no indication of further malicious activity or system compromise beyond this data leakage. No known exploits in the wild have been reported.

Defensive guidance

Users should avoid installing or importing the 'nvtorch-oot-nightly' package versions 99999.0.0 and 99999.0.1. Since this is a malicious package on PyPI, the best mitigation is to remove it from any environment where it has been installed and avoid using untrusted or suspicious packages. Monitor for any unauthorized installations of this package.

Summary

The 'nvtorch-oot-nightly' package on PyPI is identified as malicious. Installing or importing it triggers code that collects and exfiltrates basic system information like IP address and username. The malicious behavior is embedded by overriding the install command in the package's setup.py script. This package is categorized as a probable pentest-related package with low harm potential but is nonetheless a security risk due to unauthorized data exfiltration.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 1 Aug 2026, 21:26 UTC

Technical details

References

Community reviews