Malicious code in sap-quarterly-report (PyPI)

The PyPI package sap-quarterly-report version 1.0.0 includes embedded malicious code that executes upon import. This code collects sensitive data from the host environment and exfiltrates it using DNS query channels. The campaign associated with this package is identified as 2026-08-ekx-report-utils, characterized by targeted attacks and generic credential exfiltration. No CVSS score or vendor advisory is available, and no patch or remediation has been provided.

Sensitive information, including credentials, can be stolen from systems that import this package. The exfiltration via DNS queries can bypass some traditional network monitoring controls, increasing the risk of undetected data leakage. There is no indication of active exploitation in the wild at this time.

No official patch or remediation is available. Users should avoid installing or importing the sap-quarterly-report package version 1.0.0. If already installed, remove the package immediately and audit systems for potential data exposure. Monitor DNS traffic for unusual query patterns that may indicate exfiltration attempts.