MalwarePublished 16 Jun 2026Updated 9 Jul 2026

temp-development-package-test (PyPI) · Malicious Code

Affects temp-development-package-testSource GCVE Database

Malicious package : remove temp-development-package-test and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 09:29 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-5876

What to do

Remove temp-development-package-test from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPItemp-development-package-test	Affected 0.1 – 0.4 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (14f3eeecfabfcb249c5f6ec2a20824355ac313ab18c677334076ca9501607ec8) At install time, setup.py invokes install_sitecustomize(), which copies src/temp_development_package_test/setup/sitecustomize.py into Python's purelib site-packages directory as sitecustomize.py (setup.py:34 destination = site_packages / "sitecustomize.py"; setup.py:36 shutil.copy2(source, destination)). Python auto-imports sitecustomize on every interpreter startup, so this places an interpreter-wide hook outside the package's own namespace that fires for every subsequent Python process on the host — a classic persistence mechanism. The hook payload file is not actually shipped in this 0.2 sdist, so the install would currently raise FileNotFoundError, but the install-time mechanism and intent to write a global hook are unambiguous. The package metadata corroborates a throwaway / probe release: name, author, and summary are all the literal placeholder 'temp_development_package_test'; setup.py imports base64 but never uses it; cli.py imports from an unrelated, undeclared module 'pg_agent.orchestration.coordinator'. The combination — placeholder identity plus install-time write of a global interpreter hook — is not a legitimate package shape. ## Source: kam193 (5cdc1d94dd0cfb62a4a0267ae52bf1a72dfa31a6854196b4bb220759b7c6e878) Starting with version 0.4, package installs a sitecustomize.py that executes during Python engine initialization. The embeded code uses mshta to download malicious code, as in other packages from the campaign. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-easyaillm Reasons (based on the campaign): - Downloads and executes a remote executable. - obfuscation - malware - tool:mshta

Impact

If installed, the package can establish a persistent backdoor by executing malicious code every time the Python interpreter starts. This can lead to remote code execution, unauthorized system compromise, and potential malware infection. The use of mshta to download and execute remote code indicates a high risk of further payload delivery and system control by attackers. Earlier versions cause installation errors but do not drop malicious files. The threat affects any environment where this package is installed, especially on Windows systems where mshta is available.

Defensive guidance

The recommended mitigation is to reject and block installation of 'temp-development-package-test' versions 0.1 through 0.4. Conduct human review of the maintainer and any future versions to prevent supply chain compromise. Remove any existing installations of this package and monitor for unauthorized Python packages. Avoid installing packages from untrusted sources and verify package integrity before use.

Summary

The 'temp-development-package-test' PyPI package uses a setup.py script that installs a sitecustomize.py file into the Python site-packages directory. This file is automatically imported by Python on every interpreter start, enabling persistent execution of arbitrary code. From version 0.4 onward, the sitecustomize.py contains code that uses the Windows mshta tool to download and execute remote malicious payloads. Earlier versions (0.1 to 0.3) attempt to stage this persistence mechanism but fail due to a missing payload file, causing installation errors without dropping malicious files. The package is part of a broader malicious campaign (2026-06-easyaillm) characterized by malware distribution and obfuscation techniques. There is no evidence of known exploits in the wild yet. No vendor advisory or patch is available, and human review and rejection of this package and its future versions are recommended.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 9 Jul 2026, 09:51 UTC

Technical details

References

Community reviews