MalwarePublished 10 Jul 2026

turbocalc (PyPI) · Malicious Code

Affects turbocalcSource GCVE Database

Malicious package : remove turbocalc and rotate any secrets on hosts that installed it.

Data as of 12 Jul 2026, 09:18 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-10139

What to do

Remove turbocalc from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIturbocalc	Affected =0.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (ae55c7a3030f0ff3493a885460511e83e257b4bd6b3e347136c43518b3bddfa2) During import an obfuscated code starts in-memory functions from a binary blob; after that, it communicates with dockfinancial[.]lu, the exact behaviour is unknown. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-turbocalc Reasons (based on the campaign): - obfuscation - other

Impact

The presence of obfuscated malicious code that executes on import and communicates with an external domain indicates a high risk of compromise, including potential data exfiltration or further malicious activity. Since the exact behavior is unknown, the impact could range from information theft to system compromise. No known exploits in the wild have been reported yet.

Defensive guidance

Users should avoid installing or using turbocalc version 0.1.0 from PyPI. If already installed, remove the package and investigate any suspicious activity related to its use. Monitor for updates from the package maintainers or PyPI security teams for any remediation announcements.

Summary

The turbocalc PyPI package version 0.1.0 includes obfuscated malicious code that activates during import by running in-memory functions derived from a binary blob. After execution, it establishes communication with dockfinancial.lu, though the precise purpose of this communication is not detailed. This package is classified under a malicious campaign (2026-07-turbocalc) with intent consistent with malware such as infostealers. There is no CVSS score or vendor advisory indicating remediation or patch availability.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Jul 2026, 09:57 UTC

Technical details

References

Community reviews