Skip to main content
MalwarePublished

xxoo-bale (PyPI) · Malicious Code

Affects xxoo-baleSource GCVE Database

0

Malicious package : remove xxoo-bale and rotate any secrets on hosts that installed it.

Data as of 27 Oct 2026, 00:07 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-3425

What to do

Remove xxoo-bale from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
PyPIxxoo-baleAffected
  • =1.0.0
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (74ce2be8301ccea70138e307282fbf70ede26eede2a531296145f7d0da695b80) The package contains code to install remotely stored malware and ensure its persistence. The code is not triggered automatically; it requires a separate trigger. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-cas-base Reasons (based on the campaign): - Downloads and executes a remote executable. - malware - persistence

References

Community reviews

Loading reviews…