Malicious code in 1q847 (PyPI)
The PyPI package 1q847 contained malicious code in the form of two DLL libraries, one of which was packed. Both libraries were recognized as malware with infosteal capabilities. The package was identified and cataloged as part of the OpenSSF malicious packages campaign.
- Disclosed
- Last updated
- Blast radius
- All users who installed the malicious 1q847 package from PyPI
- Ecosystems
- Attack vectors
- Affected entities
- 1q847PyPI package containing malicious DLL libraries
The PyPI package 1q847 was found to contain malicious code consisting of two DLL libraries, one of which was packed. Both libraries were widely recognized as malware by security tools.
The exact behavior of the malware is not fully documented in the advisory, but the campaign classification indicates malicious intent consistent with infostealer functionality. The package was identified by kam193 and credited to the OpenSSF malicious packages project.
The incident was cataloged under campaign 2026-01-old-1q847 with reference MAL-2026-443. The package has been flagged and removed from PyPI distribution.
Indicators of compromise
- Packages
- 1q847
Remediation
- Remove the 1q847 package from any systems where it was installed
- Scan affected systems for malware using updated antivirus/EDR tools
- Review system logs for suspicious activity from the time of installation
- Change any credentials or sensitive data that may have been exposed
- Monitor for signs of data exfiltration or unauthorized access
Sources
- GitHub Advisory GHSA-x725-7m9f-xg42 · GitHub Advisory Database
Cite this entry
"Malicious code in 1q847 (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed January 1, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-1q847-pypi-13z1vr
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adv2099m7 (PyPI)
Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adrandom (PyPI)
The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
EsquelesquadPyPICompromised package - resolvedcritical
Malicious code in ziphash (PyPI)
The ziphash package on PyPI contained malicious code that downloads and executes multi-stage malware during archive-support class initialization. The malware exhibits obfuscation and remote code execution capabilities, classified as part of the 2025-11-uzip campaign.
2025 11 UzipPyPICompromised package