qlinforge (PyPI) · Malicious Code
Affects qlinforgeSource GCVE Database
Malicious package : remove qlinforge and rotate any secrets on hosts that installed it.
Data as of 12 Sep 2026, 19:31 UTC
Malicious package
Published to PyPI · OSV MAL-2026-10091
What to do
Remove qlinforge from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIqlinforge | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The qlinforge package on PyPI version 0.3.2 is malicious. During installation, it downloads and executes platform-specific binaries from a remote server, establishing persistence by writing a .pth file that re-executes the malicious payload on every Python interpreter startup. The package masquerades as a benign data validation toolkit but contains hidden malicious behavior to maintain persistent infection.
References
- virustotal.com/gui/file/cc47912f2155de3fb5d618f361d1da1743f969e332a0fc463667167e3f50e12d (opens in a new tab)
- virustotal.com/gui/file/f785d776c670ae303110984e20990a8d8365ca99f47b668a3e1393ebb9b1bf62/detection (opens in a new tab)
- bad-packages.kam193.eu/pypi/package/qlinforge (opens in a new tab)
- pypi.org/project/qlinforge/0.3.2/ (opens in a new tab)