MalwarePublished 4 Sep 2024Updated 14 Nov 2026

pymatcha (PyPI) · Malicious Code

Affects pymatchaSource GCVE Database

Malicious package : remove pymatcha and rotate any secrets on hosts that installed it.

Data as of 14 Nov 2026, 23:53 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2024-12332

What to do

Remove pymatcha from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIpymatcha	Affected =0.1 =0.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The pymatcha package on PyPI contains malicious code that downloads and executes an infostealer when imported. This behavior has been widely detected by antivirus and sandbox tools. The campaign associated with this threat is named 2024-08-embeds-RealtekHDAudioManager and is characterized by its clear malicious intent to steal information.

Impact

Systems that import the pymatcha package versions 0.1 or 0.1.0 risk having an infostealer downloaded and executed, potentially leading to unauthorized data theft. This compromises confidentiality and may lead to further system compromise depending on the infostealer's capabilities.

Defensive guidance

Avoid using the pymatcha package versions 0.1 and 0.1.0. Remove any installations of this package immediately. Use trusted sources and verify package integrity before installation. Monitor for any signs of compromise related to infostealer activity.

Summary

The pymatcha package versions 0.1 and 0.1.0 on PyPI have been identified as malicious. Importing this module triggers the download and execution of a remote infostealer executable. This activity has been widely detected by antivirus solutions and sandbox environments, confirming its malicious nature. The campaign linked to this package is known as 2024-08-embeds-RealtekHDAudioManager, which is focused on infostealing through remote code execution.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Nov 2026, 23:53 UTC

Technical details

References

Community reviews