Malicious code in 3web-py (PyPI)
The PyPI package 3web-py contained malicious code designed to function as an infostealer. The package was part of the funcaptcha-ru campaign and has been identified and cataloged by the OpenSSF malicious packages project.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation count and user exposure to malicious code execution.
- Ecosystems
- Attack vectors
- Threat actor
- Affected entities
- 3web-pyPyPI package containing malicious code
The PyPI package 3web-py was found to contain malicious code with clear intent to steal information from affected systems. The malicious payload was identified as part of the funcaptcha-ru campaign, which targets users through compromised or malicious packages.\n\nThe package was analyzed and documented by the OpenSSF's malicious packages project (MAL-2024-9934), which tracks known malicious software distributions across package ecosystems. The malicious code functions as an infostealer, designed to exfiltrate sensitive data from compromised environments.\n\nThis incident represents a direct compromise of the PyPI package repository through the distribution of intentionally malicious code under a legitimate-appearing package name.
Indicators of compromise
- Packages
- 3web-py
Remediation
- Remove 3web-py from all environments immediately
- Audit systems that installed 3web-py for signs of data exfiltration or unauthorized access
- Review access logs and network traffic from affected systems for suspicious activity
- Change credentials and secrets on any system that may have executed the malicious package
- Monitor for indicators of compromise related to the funcaptcha-ru campaign
Sources
- GitHub Advisory GHSA-pvmj-whr6-4hhj · GitHub Advisory Database
Cite this entry
"Malicious code in 3web-py (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-3web-py-pypi-kzajwr
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adv2099m7 (PyPI)
Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adrandom (PyPI)
The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
EsquelesquadPyPICompromised package - resolvedcritical
Malicious code in ziphash (PyPI)
The ziphash package on PyPI contained malicious code that downloads and executes multi-stage malware during archive-support class initialization. The malware exhibits obfuscation and remote code execution capabilities, classified as part of the 2025-11-uzip campaign.
2025 11 UzipPyPICompromised package