MalwarePublished 8 Jul 2026Updated 9 Jul 2026

pyqt6darktheme (PyPI) · Malicious Code

Affects pyqt6darkthemeSource GCVE Database

Malicious package : remove pyqt6darktheme and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 09:29 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-6960

What to do

Remove pyqt6darktheme from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIpyqt6darktheme	Affected =0.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (8cd6d16792d681b160ae1e11b3f698d8fd3004cd6019704008ad1c649fbe6f67) Package downloads and runs a remote executable, which was found to downloads further exes and starting coine mining --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-pyqt6darktheme Reasons (based on the campaign): - cryptominer - Downloads and executes a remote executable. - malware - The package overrides the install command in setup.py to execute malicious code during installation.

Impact

Systems that install and run pyqt6darktheme version 0.1.0 are at risk of executing unauthorized remote code, which leads to further malware downloads and unauthorized cryptocurrency mining. This can result in resource exhaustion, degraded system performance, and potential compromise of system integrity.

Defensive guidance

Users should avoid installing or using pyqt6darktheme version 0.1.0. Remove the package if already installed and scan affected systems for unauthorized executables and cryptomining processes. Monitor for suspicious network activity related to remote executable downloads.

Summary

The pyqt6darktheme package at version 0.1.0 is a malicious PyPI package that downloads and runs a remote executable. This executable subsequently downloads more executables and starts coin mining operations on the affected system. The campaign associated with this package is categorized as malicious, involving malware distribution and cryptomining activities. There is no CVSS score available, and no known exploits in the wild have been reported.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Jul 2026, 13:34 UTC

Technical details

References

Community reviews