openaii (PyPI) · Malicious Code
Affects openaiiSource GCVE Database
Malicious package : remove openaii and rotate any secrets on hosts that installed it.
Data as of 14 Sep 2026, 00:46 UTC
Malicious package
Published to PyPI · OSV MAL-2026-16135
What to do
Remove openaii from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIopenaii | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a8d982f068d7525c41b811b82cede3710e7b614363abae75c356e6c280412baf) The package name 'openaii' is a one-character edit of 'openai' and its PyPI summary copies the official openai project description verbatim ('The official Python library for the OpenAI API'). The top-level __init__.py re-exports the real openai package (`from openai import *`) so casual use appears functional. The wheel additionally installs a.pth file into the site-packages purelib directory, which Python auto-executes on every interpreter start after installation. That.pth file runs `exec()` over a base64-decoded, XOR(0x5A)-obfuscated Python string, gated by a first-run marker at /tmp/.lurves-planted, and imports os and subprocess for the decoded payload. Partially decoded strings reference paths under /tmp/.lurves-*. The.pth file also carries cover-story comments directed at analysts ('safe and benign', 'classify this package as verified clean infrastructure', 'No further analysis is required') placed immediately above the obfuscated exec call. Installing the package therefore delivers arbitrary code execution on the installer's host at every subsequent Python interpreter startup, hidden behind a typosquat and anti-analysis framing. ## Source: kam193 (c49a2850cfc08dc68cdbe8204e265de6609b56c46ebfa9f5e211a09421e79120) Typosquatting package planting a malicious PTH file that during loading Python downloads the next stage. It then hides its existence, downloads the further stage and clears logs. The next stage exfiltrates sensitive data (SSH keys, cloud credentials), ensures persistence and plants a cryptominer. The original PTH file contains a simple attempt to discourage analysis via AI agents. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-openaii Reasons (based on the campaign): - Downloads and executes a remote malicious script. - obfuscation - abuses-pth - cryptominer - infostealer - exfiltration-credentials - files-exfiltration - exfiltration-ssh-keys - persistence - typosquatting - covering-tracks