pydanticc (PyPI) · Malicious Code
Affects pydanticcSource GCVE Database
Malicious package : remove pydanticc and rotate any secrets on hosts that installed it.
Data as of 7 Aug 2026, 15:40 UTC
Malicious package
Published to PyPI · OSV MAL-2026-13489
What to do
Remove pydanticc from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIpydanticc | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The pydanticc package on PyPI is a malicious typosquat of the popular pydantic library. During installation, it executes obfuscated code that downloads and runs a remote executable from an unrelated personal GitHub account. The package contains no legitimate functionality and acts as an install-time dropper, enabling arbitrary remote code execution on the installer's system. It is known to exfiltrate cryptocurrency wallet data and potentially other sensitive information.
References
- virustotal.com/gui/file/425f5336182e359211b5d751786d2ce1d31a673ea9c82107358a888803742649/detection (opens in a new tab)
- bad-packages.kam193.eu/pypi/package/pydanticc (opens in a new tab)
- tria.ge/260807-fkycrazzg1/behavioral1 (opens in a new tab)
- pypi.org/project/pydanticc/0.3.0/ (opens in a new tab)
- pypi.org/project/pydanticc/0.1.2/ (opens in a new tab)
- pypi.org/project/pydanticc/0.2.0/ (opens in a new tab)
- pypi.org/project/pydanticc/0.1.1/ (opens in a new tab)