MalwarePublished 25 Oct 2026

zagents-message-bus (PyPI) · Malicious Code

Affects zagents-message-busSource GCVE Database

What to do

Affected software

Product	Affected	Fixed in
PyPIzagents-message-bus	Affected =1.0.5 =1.0.10 =99.99.99 =99.99.100	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The PyPI package 'zagents-message-bus' contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in its setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.

Impact

The impact is limited to the exfiltration of basic host information such as IP address and username. There is no indication of further malicious activity or exploitation beyond this data leakage. No known exploits in the wild have been reported.

Defensive guidance

The best mitigation is to avoid installing or importing the 'zagents-message-bus' package, especially the affected versions =1.0.5, =1.0.10, =99.99.99, and =99.99.100. Users should verify package authenticity before installation and prefer trusted sources.

Summary

The 'zagents-message-bus' package on PyPI is a malicious package that, when installed or imported, executes code to collect and exfiltrate basic system information including IP address and username. This is achieved by overriding the install command in setup.py, causing the malicious code to run during installation. The package does not provide any legitimate functionality and is categorized as a low-harm pentest-like package with limited risk.

References

bad-packages.kam193.eu/pypi/package/zagents-message-bus (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 25 Oct 2026, 22:40 UTC

Technical details

References

Community reviews