MalwarePublished 26 Jun 2026Updated 9 Jul 2026

sqligen (PyPI) · Malicious Code

Affects sqligenSource GCVE Database

Malicious package : remove sqligen and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 13:05 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-6515

What to do

Remove sqligen from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIsqligen	Affected 1.0.0 – 1.1.4 8 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The sqligen package on PyPI contains malicious code that executes a remote payload during installation on Windows systems. The setup.py file includes obfuscated code that triggers execution of a remote HTA file via mshta.exe, resulting in arbitrary code execution under the installing user's privileges. This malicious behavior is hidden behind misleading variable names and encoding to evade detection. The threat affects multiple specific versions of sqligen and is classified as critical due to the potential for remote code execution.

Impact

Successful installation of the affected sqligen versions on Windows systems results in execution of attacker-controlled code with the privileges of the installing user. This can lead to full compromise of the affected host, including potential data theft, persistence, or further malware deployment. The obfuscation and remote payload delivery increase the risk of unnoticed compromise during routine package installation.

Defensive guidance

Users should avoid installing sqligen versions 1.0.0, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.1.1, 1.1.3, and 1.1.4 from PyPI. Verify package integrity and source before installation, and consider using trusted package sources or mirrors. Monitor for any unexpected network connections to suspicious domains such as fixars.top during installation. Remove any installations of the affected versions and scan affected systems for compromise.

Summary

The sqligen PyPI package versions 1.0.0, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.1.1, 1.1.3, and 1.1.4 contain an obfuscated install-time dropper in setup.py that executes a remote HTA payload on Windows via mshta.exe. This is triggered during installation commands such as pip install or pip install -e. The code uses arithmetic chr-shift encoding and misleading variable names to conceal the command and URL 'https://fixars.top'. The remote payload is attacker-controlled and unrelated to the package's stated functionality, enabling arbitrary remote code execution under the user's account.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 13:05 UTC

Technical details

References

Community reviews