Malicious code in spaysdata (PyPI)

The 'spaysdata' package on PyPI contains embedded malicious code designed to steal Roblox cookies from users' machines, enabling potential unauthorized access to Roblox accounts. This infostealer campaign, identified as '2026-06-spaysrbdata', affects specific versions of the package listed explicitly. No vendor advisory or patch information is available, and no active exploitation has been confirmed. The threat is categorized as a malicious package rather than a software vulnerability in the traditional sense.

If a user installs or uses the affected 'spaysdata' package versions, their Roblox cookies may be exfiltrated, potentially leading to account compromise or unauthorized access. This poses a privacy and security risk to affected users. There is no indication of broader system compromise beyond the theft of Roblox cookies.

Since no official patch or remediation guidance is provided, the primary mitigation is to avoid installing or using the 'spaysdata' package versions 0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.4.2, 0.4.4, and 0.4.5. Users should verify the integrity and trustworthiness of PyPI packages before installation and consider removing any existing installations of these versions. Monitoring for suspicious activity related to Roblox accounts is also advisable.