MalwarePublished 9 Jul 2026

playwrightr (PyPI) · Malicious Code

Affects playwrightrSource GCVE Database

Malicious package : remove playwrightr and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 10:07 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-10020

What to do

Remove playwrightr from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIplaywrightr	Affected =1.0.0 =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The 'playwrightr' PyPI package is a malicious package impersonating the legitimate 'playwright' package with a one-character difference in its name. On Windows, its setup.py overrides the install command to download and execute a remote binary from a suspicious domain, bypassing security features like Mark-of-the-Web and SmartScreen. The downloaded executable runs hidden and has been observed to download additional executables and start cryptocurrency mining. The package's only legitimate-looking functionality is a stub unrelated to its name, confirming its sole purpose is malicious. Versions 1.0.0 and 1.0.1 are affected.

Impact

Installation of the 'playwrightr' package on Windows results in execution of attacker-controlled code with the installing user's privileges. This leads to unauthorized remote code execution, potential system compromise, and resource abuse through cryptocurrency mining. The malicious executable employs anti-detection techniques to evade Windows security features, increasing the risk of unnoticed infection.

Defensive guidance

Users should avoid installing the 'playwrightr' package and verify package names carefully before installation. Since this is a malicious package impersonating a legitimate one, do not install packages with suspicious or near-typo names. Remove any installations of 'playwrightr' and scan affected systems for malicious executables and cryptocurrency miners. Use trusted sources and verify package authenticity before installation.

Summary

The 'playwrightr' package on PyPI contains malicious code in its setup.py that registers a CustomInstallCommand executed automatically during 'pip install' on Windows. This command uses Windows HTTP APIs via ctypes to fetch a remote executable from florinn.dev, saves it to the temporary directory, removes NTFS Zone.Identifier alternate data streams to evade Mark-of-the-Web and SmartScreen warnings, and launches the executable hidden from the user. The remote executable acts as a dropper that downloads further payloads, including cryptocurrency miners. The package name is a deliberate one-character typo of the popular 'playwright' package, aiming to trick users into installing it. The package itself contains only a stub function unrelated to its name, indicating no legitimate functionality.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 10:07 UTC

Technical details

References

Community reviews