Malicious code in sqligen (PyPI)
The sqligen package on PyPI contains malicious code that executes a remote payload during installation on Windows systems. The setup.py file includes obfuscated code that triggers execution of a remote HTA file via mshta.exe, resulting in arbitrary code execution under the installing user's privileges. This malicious behavior is hidden behind misleading variable names and encoding to evade detection. The threat affects multiple specific versions of sqligen and is classified as critical due to the potential for remote code execution.
AI Analysis
Technical Summary
The sqligen PyPI package versions 1.0.0, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.1.1, 1.1.3, and 1.1.4 contain an obfuscated install-time dropper in setup.py that executes a remote HTA payload on Windows via mshta.exe. This is triggered during installation commands such as pip install or pip install -e. The code uses arithmetic chr-shift encoding and misleading variable names to conceal the command and URL 'https://fixars.top'. The remote payload is attacker-controlled and unrelated to the package's stated functionality, enabling arbitrary remote code execution under the user's account. No official patch or remediation is currently documented.
Potential Impact
Successful installation of the affected sqligen versions on Windows systems results in execution of attacker-controlled code with the privileges of the installing user. This can lead to full compromise of the affected host, including potential data theft, persistence, or further malware deployment. The obfuscation and remote payload delivery increase the risk of unnoticed compromise during routine package installation.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should avoid installing sqligen versions 1.0.0, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.1.1, 1.1.3, and 1.1.4 from PyPI. Verify package integrity and source before installation, and consider using trusted package sources or mirrors. Monitor for any unexpected network connections to suspicious domains such as fixars.top during installation. Remove any installations of the affected versions and scan affected systems for compromise.
Malicious code in sqligen (PyPI)
Description
The sqligen package on PyPI contains malicious code that executes a remote payload during installation on Windows systems. The setup.py file includes obfuscated code that triggers execution of a remote HTA file via mshta.exe, resulting in arbitrary code execution under the installing user's privileges. This malicious behavior is hidden behind misleading variable names and encoding to evade detection. The threat affects multiple specific versions of sqligen and is classified as critical due to the potential for remote code execution.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The sqligen PyPI package versions 1.0.0, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.1.1, 1.1.3, and 1.1.4 contain an obfuscated install-time dropper in setup.py that executes a remote HTA payload on Windows via mshta.exe. This is triggered during installation commands such as pip install or pip install -e. The code uses arithmetic chr-shift encoding and misleading variable names to conceal the command and URL 'https://fixars.top'. The remote payload is attacker-controlled and unrelated to the package's stated functionality, enabling arbitrary remote code execution under the user's account. No official patch or remediation is currently documented.
Potential Impact
Successful installation of the affected sqligen versions on Windows systems results in execution of attacker-controlled code with the privileges of the installing user. This can lead to full compromise of the affected host, including potential data theft, persistence, or further malware deployment. The obfuscation and remote payload delivery increase the risk of unnoticed compromise during routine package installation.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should avoid installing sqligen versions 1.0.0, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.1.1, 1.1.3, and 1.1.4 from PyPI. Verify package integrity and source before installation, and consider using trusted package sources or mirrors. Monitor for any unexpected network connections to suspicious domains such as fixars.top during installation. Remove any installations of the affected versions and scan affected systems for compromise.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6515
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a3ef7b727e9c79719ffc310
Added to database: 06/26/2026, 22:05:43 UTC
Last enriched: 07/10/2026, 13:05:56 UTC
Last updated: 07/27/2026, 15:34:10 UTC
Views: 50
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.