MalwarePublished 26 Jun 2026

openblox (PyPI) · Malicious Code

Affects openbloxSource GCVE Database

Malicious package : remove openblox and rotate any secrets on hosts that installed it.

Data as of 26 Jun 2026, 22:30 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-6504

What to do

Remove openblox from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIopenblox	Affected =1.0.1 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The openblox PyPI package versions 1.0.0 and 1.0.1 contain malicious code that executes during installation. The setup.py script runs a function that constructs and executes a command to launch mshta.exe with a remote URL, causing the download and execution of remote malicious code. The package masquerades as a Roblox-related library but actually contains unrelated code and obfuscated commands to evade detection.

Impact

Installing the affected versions of the openblox package leads to arbitrary code execution on the victim's Windows machine via mshta.exe executing a remote script. This can allow an attacker to run any code with the privileges of the user performing the installation, potentially leading to full system compromise or further malware deployment.

Defensive guidance

Users should avoid installing the openblox package versions 1.0.0 and 1.0.1 from PyPI. Verify package authenticity before installation and consider using trusted package sources or mirrors. Monitor for updates from the package maintainer or PyPI for any official fixes or removals.

Summary

The openblox package on PyPI, specifically versions 1.0.0 and 1.0.1, includes a malicious setup.py script that unconditionally executes a function at install time. This function reconstructs obfuscated strings to form a command invoking the Windows mshta.exe utility to fetch and run a remote HTA/JScript payload from https://fixars.top. This results in arbitrary code execution on the installer's machine. The obfuscation uses character arithmetic to hide the URL and command from static analysis. The package also uses misleading metadata and a Roblox-themed name to attract users intending to install a legitimate library, effectively acting as a trojanized package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Jun 2026, 22:30 UTC

Technical details

References

Community reviews