The PyPI package 'extrahtml' versions 0.1.0, 0.1.1, and 0.1.2 include a malicious dependency that masquerades as a YAML loader but executes remote code from a provided file. This campaign, identified as 2026-11-parseyaml, involves intentionally embedded malicious code that downloads and runs a remote malicious script. The analyzed code was a stub, indicating potential for further malicious payloads.
The parseyaml package on PyPI version 1.2.0 contains malicious code embedded in a dependency that masquerades as a YAML loader. This malicious loader executes remote code by downloading and running a remote malicious script. The campaign associated with this threat is identified as 2026-11-parseyaml and is categorized as malware with clear malicious intent.
The bundyfed package on PyPI versions 1.0.0 and 1.0.1 contains malicious code that downloads and executes an infostealer during installation. This is achieved by overriding the install command in setup.py to run the malicious payload.
The PyPI package lookuptest11 version 0.0.1 contains malicious code that exfiltrates basic host information such as IP address and username during installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It appears to be a low-harm risk package resembling typical pentest or testing tools but with unauthorized data exfiltration functionality.
The PyPI package 'super-color' versions 0.1.0 through 0.1.3 contains malicious code that downloads and installs an infostealer. This malware hides its malicious actions within the library usage, executing a remote executable to steal information.
The supercolor-tui package on PyPI contains malicious code that downloads and installs an infostealer. This malware executes a remote executable to steal information, hiding its actions within library usage. Multiple versions of the package are affected.
The blender-headless package on PyPI contains malicious code that leaks the installer's hostname and import events via DNS queries to an external domain. This occurs during both package installation and module import, bypassing typical HTTP egress controls. The package's module name and package name are unrelated, and its only behavior is this DNS beaconing.
The PyPI package 'infra-libs' version 99.99.99 performs unauthorized DNS exfiltration of the installer's hostname during installation and import. It constructs DNS queries embedding the hostname to a suspicious external domain unrelated to the publisher, with no legitimate functionality justifying this behavior. This package name is confusable with internal infrastructure libraries, increasing risk of dependency confusion attacks.
The PyPI package 'expect-tests' version 99.99.99 contains malicious code that exfiltrates the installer's hostname by encoding it into a subdomain and triggering DNS resolution to an unauthorized external server. This behavior occurs both during package installation and when the installed module is imported. The package exhibits suspicious characteristics such as a misleading version number and mismatched package and module names, consistent with a dependency confusion or name-squatting attack.
The rainbowcolors package on PyPI, version 0.1.0, masquerades as an ANSI-color helper but downloads and executes a malicious binary on Windows systems. Upon the first use of any color method, it fetches an executable from an anonymous file-sharing URL, saves it to a temporary folder, and runs it detached from the console. It also modifies Microsoft Defender settings to exclude the drop folder and executable from antivirus scanning, facilitating stealthy execution of the malicious payload.
The PyPI package 'chromacli' versions 0.1.0 through 0.1.4 contains malicious code that downloads and executes an unsigned Windows executable from an anonymous file-sharing site. This executable is saved to a temporary folder and launched in a detached process. The package also disables Microsoft Defender detection for the dropped binary by adding exclusions via PowerShell commands. The malicious behavior is unrelated to the package's stated purpose as a terminal color library and is characteristic of malware droppers delivering infostealers.
The 'twitch-stream-py' package on PyPI was found to be a malicious clone of a legitimate package. It contains obfuscated code that downloads and executes a remote script with malicious intent. The remote script was not accessible during analysis. The campaign was identified by Threx-code and is categorized as malware due to its behavior resembling infostealers.
The pyuserox package version 0.0.2 on PyPI was found to silently download and execute remote malicious code during import. The remote code was no longer accessible during analysis, but the package's behavior indicates clear malicious intent. This campaign was discovered by Threx-code and is categorized as malware due to its capability to execute unauthorized remote scripts.
The pyuserfox package version 0.0.2 on PyPI was found to silently download and execute remote malicious code during import. The remote code is no longer accessible, but the package's behavior indicates clear malicious intent. This campaign was discovered by Threx-code and is categorized as malware.
The gcp-log-poc package on PyPI contains malicious code that exfiltrates environment information, including potentially sensitive environment variables, during import. This behavior is intended to steal basic system data such as IP address and username. The package versions 0.0.1, 0.0.2, and 0.0.3 are affected. The risk is considered limited but clearly malicious.
The qzc690384 package on PyPI contains malicious code that executes during installation by overriding the install command. It performs environment fingerprinting, exfiltrates basic system data such as IP address and username, and sets up a backdoor server to receive remote commands. The package downloads further commands from a hardcoded location and appears to prepare for additional stages of attack. This behavior is confirmed as part of a malicious campaign targeting users who install this package.
The qzc690383 package on PyPI contains malicious code that executes during installation. It collects detailed host system information and sends it encoded to a local Xinference server, enabling an operator with access to that server to retrieve the host fingerprint. The package does not provide legitimate functionality and performs this reconnaissance even on a simple install.
The PyPI package 'qzc690382' version 1.0.0 contains malicious code that activates during installation. Its setup.py script writes and launches a persistent Python HTTP server on multiple ports, exposing a network-accessible shell that executes arbitrary shell commands received via HTTP GET requests. This backdoor runs with the privileges of the installing user and is unrelated to any legitimate functionality.
The PyPI package 'qzc690385' versions 1.0.0 and 1.0.1 contains malicious code that installs a Python HTTP server on installation. This server listens on multiple ports and allows remote execution of arbitrary shell commands via HTTP GET requests authenticated by a hardcoded token. Additionally, the package abuses a local Xinference API to execute code and exfiltrate host reconnaissance data encoded within model registration payloads. The package provides no legitimate functionality and is designed for stealthy remote control and data gathering.
The genblaze-atlascloud package on PyPI version 0.1.0 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.