MalwarePublished 17 Sep 2026Updated 23 Sep 2026

pyjstat-smooth (PyPI) · Malicious Code

Affects pyjstat-smoothSource GCVE Database

Malicious package : remove pyjstat-smooth and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:20 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-16267

What to do

Remove pyjstat-smooth from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIpyjstat-smooth	Affected 1.5.0 – 2.5.17 18 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The pyjstat-smooth package on PyPI contains malicious code designed to exfiltrate specific files from a user's machine. The file paths targeted suggest the malware was intended for use in a Capture The Flag (CTF)-like environment. This package is a clone of a legitimate package but includes obfuscated code with clear malicious intent to steal information.

Impact

The malicious code can lead to unauthorized data exfiltration from affected systems, potentially compromising sensitive information. The targeted nature of the file paths suggests a focused attack scenario rather than broad indiscriminate infection. There is no evidence of widespread exploitation currently.

Defensive guidance

Users should immediately uninstall the pyjstat-smooth package versions listed as affected and avoid installing packages from untrusted sources. Verify package authenticity before installation, especially for packages that clone legitimate ones. Monitor for suspicious network activity related to file exfiltration.

Summary

The pyjstat-smooth package includes hidden code that exfiltrates files from infected systems. The targeted file paths indicate a focus on environments similar to CTF challenges. The package uses obfuscation techniques and impersonates a legitimate package to evade detection. This campaign is categorized as malicious with intent to steal data, but there is no indication of active exploitation in the wild or a CVSS score.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 18 Sep 2026, 01:22 UTC

Technical details

References

Community reviews