xxx-bale (PyPI) · Malicious Code
Affects xxx-baleSource GCVE Database
Malicious package : remove xxx-bale and rotate any secrets on hosts that installed it.
Data as of 27 Oct 2026, 00:44 UTC
Malicious package
Published to PyPI · OSV MAL-2026-3428
What to do
Remove xxx-bale from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIxxx-bale | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The PyPI package 'xxx-bale' version 1.0.0 contains malicious code designed to download and execute remotely stored malware and maintain its persistence. The malicious code is not triggered automatically and requires a separate activation step. This package is part of a campaign with clear malicious intent, including infostealing capabilities.
References
- virustotal.com/gui/file/94b4fd98f0f168d999753bed16817ba15b0f17e7373819e3c383feac9dac58c1/detection (opens in a new tab)
- virustotal.com/gui/file/20377b8ee72f1371ed41228f47d4bce20b1b3c89b8465626fb78bc3f18ea935e/detection (opens in a new tab)
- virustotal.com/gui/file/0338390d7b545f2695622df543b67b9a87131416b71dfb368a874a335a55238f/detection (opens in a new tab)
- github.com/kamakshyatest4/python-malware/blob/45f86d614fd5c8c01d844a458d56c292c7c060c2/requirements.txt (opens in a new tab)
- tria.ge/250712-jwamlsyxat (opens in a new tab)
- virustotal.com/gui/file/cd4e27e9d32c1ef71a49c3c7695be591cb3400763b22471347c4af1db366685e (opens in a new tab)
- virustotal.com/gui/file/40b64916c5a38fde2b9939c674a2eaefd39df6216014e35a86b596746d34e2e9 (opens in a new tab)
- bad-packages.kam193.eu/pypi/package/xxx-bale (opens in a new tab)