Malicious code in spaysrbdata (PyPI)

The spaysrbdata PyPI package versions 0.1.0, 0.2.0, 0.3.0, 0.4.0, and 0.5.0 contain malicious code designed to steal Roblox cookies from victim machines. This behavior classifies the package as an infostealer with clear malicious intent. The campaign associated with this threat is identified as 2026-06-spaysrbdata. There is no information on active exploitation in the wild or vendor remediation.

Compromise of Roblox user session cookies can lead to unauthorized access to user accounts, potentially resulting in account takeover and loss of user data or assets. The malicious package poses a direct threat to users who install it, as it exfiltrates sensitive authentication tokens.

No official patch or remediation is documented. Users should avoid installing the spaysrbdata package versions 0.1.0 through 0.5.0. If installed, remove the package immediately and monitor for any suspicious activity related to Roblox accounts. Use trusted sources for Python packages and verify package integrity before installation.