MalwarePublished 3 Jul 2026Updated 8 Jul 2026

procwire (PyPI) · Malicious Code

Affects procwireSource GCVE Database

Malicious package : remove procwire and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-6750

What to do

Remove procwire from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIprocwire	Affected 5.2.3 – 5.2.7 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The procwire package on PyPI contains malicious code that executes during installation by overriding the install command. It downloads and runs a remote executable, which is likely an infostealer, contacting a suspicious domain. The malicious payload is obfuscated and hidden using steganography and encoded data within dependencies. This threat also affects packages depending on procwire, such as confighub, spreading the malware further. The affected versions are 5.2.3, 5.2.5, 5.2.6, and 5.2.7.

Impact

The malicious code executes during package installation, leading to the download and execution of a remote infostealer executable. This compromises the host system by potentially stealing sensitive information. The infection can propagate through dependencies, affecting other packages that rely on procwire. The obfuscation and steganography techniques hinder detection and analysis.

Defensive guidance

Users should immediately avoid installing or using procwire versions 5.2.3, 5.2.5, 5.2.6, and 5.2.7. Audit and remove any installations of these versions. Monitor dependency chains for confighub or other packages depending on procwire and treat them as potentially compromised. Check vendor advisories or PyPI security notices for updates or removal of the malicious packages.

Summary

The procwire PyPI package is part of a malicious campaign involving multiple packages. It overrides the setup.py install command to execute malicious code that downloads and runs a remote executable. This executable likely functions as an infostealer and communicates with the domain 030502[.]xyz. The malware uses obfuscation techniques including steganography in a bundled image and encoded byte arrays decoded by a custom method in a dependency. Additionally, procwire is a dependency of confighub, thereby extending the infection chain. The campaign is identified as MAL-2026-6750 and targets specific procwire versions.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 4 Jul 2026, 22:52 UTC

Technical details

References

Community reviews

Related threats