renderctx (PyPI) · Malicious Code
Affects renderctxSource GCVE Database
Malicious package : remove renderctx and rotate any secrets on hosts that installed it.
Data as of 27 Oct 2026, 00:40 UTC
Malicious package
Published to PyPI · OSV MAL-2026-3207
What to do
Remove renderctx from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIrenderctx | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The renderctx PyPI package contains malicious code designed to exfiltrate sensitive files such as .env files, logs, text files, or code files from users who install it. It may also establish persistent backdoors by embedding hardcoded SSH keys. This malicious code is embedded in dependencies of the package and is linked to a campaign likely attributed to North Korean threat actors targeting developers through fake cryptocurrency-related projects and fake interviews.
References
- bad-packages.kam193.eu/pypi/package/renderctx (opens in a new tab)
- github.com/0xsebasneuron (opens in a new tab)
- socket.dev/supply-chain-attacks/north-korea-s-contagious-interview-campaign (opens in a new tab)
- github.com/0xsebasneuron/polymarket-arbitrage-copy-trading-bot-V2/commit/4dae9aea3c35a627a7f38a28946f73af18930a3e (opens in a new tab)