MalwarePublished 8 Nov 2026

rainbowcolors (PyPI) · Malicious Code

Affects rainbowcolorsSource GCVE Database

Malicious package : remove rainbowcolors and rotate any secrets on hosts that installed it.

Data as of 8 Nov 2026, 10:52 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-18762

What to do

Remove rainbowcolors from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIrainbowcolors	Affected =0.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The rainbowcolors package on PyPI, version 0.1.0, masquerades as an ANSI-color helper but downloads and executes a malicious binary on Windows systems. Upon the first use of any color method, it fetches an executable from an anonymous file-sharing URL, saves it to a temporary folder, and runs it detached from the console. It also modifies Microsoft Defender settings to exclude the drop folder and executable from antivirus scanning, facilitating stealthy execution of the malicious payload.

Impact

This package enables remote code execution on Windows systems by downloading and running an opaque executable from an untrusted source. The use of Microsoft Defender exclusions allows the malicious binary to evade antivirus detection, increasing the likelihood of persistent and stealthy compromise. The impact includes potential full system compromise depending on the payload of the downloaded executable.

Defensive guidance

Users should immediately uninstall the rainbowcolors package version 0.1.0 and avoid using it. Scan affected systems for the presence of the solace.exe binary and remove any instances found. Review and remove any Microsoft Defender exclusions related to this package or its drop folder. Employ endpoint detection and response tools to investigate any suspicious activity related to this executable.

Summary

The rainbowcolors PyPI package (version 0.1.0) is a malicious package that pretends to provide ANSI color functionality. On Windows, the first invocation of any color-related method triggers the download of an unrelated executable (solace.exe) from an anonymous gofile.io URL into the %TEMP%\SolaceRuntime directory. The package then executes this binary with a detached process. To evade detection, it uses PowerShell commands to add exclusions to Microsoft Defender for both the folder and the executable. The downloaded binary is unrelated to the advertised functionality and is retrieved without any integrity verification, indicating a high risk of malicious activity.

References

pypi.org/project/rainbowcolors/0.1.0/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Nov 2026, 10:52 UTC

Technical details

References

Community reviews