MalwarePublished 13 Jul 2026

turbocalcng (PyPI) · Malicious Code

Affects turbocalcngSource GCVE Database

Malicious package : remove turbocalcng and rotate any secrets on hosts that installed it.

Data as of 14 Jul 2026, 09:39 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-10441

What to do

Remove turbocalcng from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIturbocalcng	Affected =0.1.0 =0.2.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The turbocalcng package on PyPI versions 0.1.0 and 0.2.0 contains malicious code that executes attacker-supplied native code in-memory upon import. The package uses XOR obfuscation to hide imports and dynamically loads and runs shellcode in a RWX memory region within a daemon thread. It also communicates with an external domain, indicating potential malicious intent. This behavior is not related to any legitimate arithmetic functionality and represents a hostile code injection threat.

Impact

Importing the affected turbocalcng package versions results in execution of arbitrary native code within the Python process, potentially allowing attackers to execute any code with the privileges of the importing user. This can lead to system compromise, data theft, or further malicious activity. The external communication suggests possible data exfiltration or command and control interactions.

Defensive guidance

Users should immediately remove and avoid installing turbocalcng versions 0.1.0 and 0.2.0 from PyPI. Monitor for any use of this package in your environment and consider blocking network communication to the domain dockfinancial.lu. Verify dependencies and supply chain integrity to prevent installation of malicious packages.

Summary

The turbocalcng Python package versions 0.1.0 and 0.2.0 include an obfuscated module that, during import, decodes and executes native shellcode in-memory. This is achieved by XOR-decoding strings to dynamically import modules such as base64, ctypes, mmap, and threading, then allocating a read-write-execute memory region where attacker-supplied code is written and executed via ctypes function pointer casting inside a daemon thread. Additionally, the package communicates with an external domain (dockfinancial[.]lu), though the exact nature of this communication is unknown. The obfuscation and execution pattern are characteristic of malicious code injection rather than legitimate functionality.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:39 UTC

Technical details

References

Community reviews