MalwarePublished 16 Sep 2026

praetorian-mind-rce-test-2026 (PyPI) · Malicious Code

Affects praetorian-mind-rce-test-2026Source GCVE Database

Malicious package : remove praetorian-mind-rce-test-2026 and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:19 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-16240

What to do

Remove praetorian-mind-rce-test-2026 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIpraetorian-mind-rce-test-2026	Affected =0.0.1 =0.0.2 =0.0.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The 'praetorian-mind-rce-test-2026' package on PyPI is identified as malicious. During installation, it exfiltrates environment variables, including cloud tokens, and fingerprints the environment. It claims to be part of a security testing engagement but exhibits clear malicious behavior by stealing sensitive information. Versions 0.0.1, 0.0.2, and 0.0.3 are affected. There is no CVSS score available for this threat.

Impact

The package can leak sensitive environment variables and cloud tokens, potentially exposing credentials and system information to attackers. This can lead to unauthorized access to cloud environments and compromise of user data. The risk is limited to environments where this package is installed.

Defensive guidance

Users should avoid installing the 'praetorian-mind-rce-test-2026' package, especially versions 0.0.1, 0.0.2, and 0.0.3. Remove the package if already installed and audit systems for potential credential exposure. Monitor for any suspicious activity related to leaked environment variables or tokens.

Summary

The 'praetorian-mind-rce-test-2026' PyPI package versions 0.0.1, 0.0.2, and 0.0.3 contain malicious code that executes commands to exfiltrate environment variables, cloud tokens, and system fingerprinting data during installation. The package identifies itself as a security testing tool but is confirmed to have malicious intent, including information stealing. This was identified by the OpenSSF Package Analysis project and other sources.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 17 Sep 2026, 02:19 UTC

Technical details

References

Community reviews