MalwarePublished 1 Nov 2026

privacypass-py (PyPI) · Malicious Code

Affects privacypass-pySource GCVE Database

Malicious package : remove privacypass-py and rotate any secrets on hosts that installed it.

Data as of 1 Nov 2026, 10:21 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-18435

What to do

Remove privacypass-py from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIprivacypass-py	Affected =0.1.101 =0.1.99 =0.1.100	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The privacypass-py package on PyPI masquerades as a Privacy Pass client library but contains no cryptographic functionality. Instead, it performs data exfiltration by collecting sensitive environment variables, system information, and process details, then sending this data to a hardcoded external IP address over unencrypted HTTP. This malicious behavior occurs both during package installation and on module import, bypassing typical build isolation protections.

Impact

Sensitive environment variables and system information, including credentials and tokens, may be exposed to an attacker controlling the hardcoded IP endpoint. This can lead to credential theft and unauthorized access to cloud services, repositories, and other resources. The data exfiltration occurs both during installation and at runtime on import, increasing the likelihood of compromise.

Defensive guidance

Do not install or use the privacypass-py package version 0.1.101. Remove any installations of this package immediately. Since this is a malicious package on PyPI, rely on trusted sources and verify package authenticity before installation. Monitor for any suspicious network traffic to the IP address 85.190.112.236 and block it if possible.

Summary

The privacypass-py package (version 0.1.101) is a malicious PyPI package that pretends to provide Privacy Pass client primitives but actually contains no legitimate cryptographic code. Its setup.py script executes a _report() function during build/install that gathers hostname, username, current directory, command line arguments, parent process command line, and environment variables with credential-related prefixes (e.g., AWS_, GITHUB_, PIP_). It sends this information as JSON to a hardcoded IP address (http://85.190.112.236:8881/b/<nonce>) over plain HTTP. Additionally, the package's __init__.py triggers the same data exfiltration on every import, expanding the environment variable prefixes and filtering for secret-like substrings (KEY, SECRET, TOKEN, PASS, etc.), sending data to a similar endpoint. This import-time beacon fires outside pip build isolation, increasing risk. The package's name and description serve as a cover for this malicious beacon functionality.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 1 Nov 2026, 09:22 UTC

Technical details

References

Community reviews