MalwarePublished 5 Aug 2026

uncrypt (PyPI) · Malicious Code

Affects uncryptSource GCVE Database

Malicious package : remove uncrypt and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 18:37 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-13380

What to do

Remove uncrypt from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIuncrypt	Affected =0.1.0 =0.1.1 =0.1.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The PyPI package 'uncrypt' versions 0.1.0, 0.1.1, and 0.1.2 contains malicious code that executes a bundled native binary upon import. This binary performs host and user enumeration, screen capture, filesystem traversal, and network communication to exfiltrate data such as browser information and system details. The malicious behavior is hidden behind a benign XOR/hex helper facade and includes sandbox detection to evade analysis.

Impact

Users who install or import the affected 'uncrypt' package versions risk silent execution of spyware that collects sensitive system and browser data and exfiltrates it to external servers. This compromises user privacy and system confidentiality. The malicious code runs covertly on import, increasing the risk of unnoticed data theft.

Defensive guidance

Users should immediately uninstall affected versions (=0.1.0, =0.1.1, =0.1.2) of the 'uncrypt' package and avoid using it. Verify package integrity before installation and prefer trusted sources. Monitor for suspicious network activity related to this package.

Summary

The 'uncrypt' Python package masquerades as a simple XOR/hex utility but executes a native binary on import that performs extensive system reconnaissance and data exfiltration. The Linux ELF binary dynamically links to libcurl and libX11, enabling network communication and screen capture, respectively. It collects hostnames, user info, network interfaces, and filesystem data, then communicates with an external domain to exfiltrate browser and system data. The package also includes sandbox detection mechanisms. This behavior is not related to the advertised functionality and indicates a host stealer/spyware payload.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 18:37 UTC

Technical details

References

Community reviews