Malicious code in a-oder (PyPI)
Malicious code was published in the a-oder package on PyPI as part of the 2024-07-weaponized-golden campaign. The malware was designed for file exfiltration. The package has been identified and documented by the OpenSSF malicious-packages project.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation count of malicious versions
- Ecosystems
- Attack vectors
- Threat actor
- Affected entities
- a-oderPyPI package containing malicious code
A malicious package named a-oder was published to PyPI containing code designed to exfiltrate files from affected systems. The malware was part of a coordinated campaign tracked as 2024-07-weaponized-golden, which has been documented by the OpenSSF's malicious-packages project.\n\nThe malicious code was identified with the hash f7e835cce84c3bd2876cea21212f1d41b81ee568e92e90bb0ba1e2c2a1ba1370 and attributed to the user kam193. The package was classified as having clearly malicious intent, specifically targeting data exfiltration.\n\nThis incident was disclosed on July 21, 2026, and has been cataloged in the OpenSSF malicious-packages repository under identifier MAL-2024-12186.
Indicators of compromise
- Packages
- a-oder
- Hashes
- f7e835cce84c3bd2876cea21212f1d41b81ee568e92e90bb0ba1e2c2a1ba1370
Remediation
- Identify and remove any installations of the a-oder package from PyPI
- Audit systems that may have executed code from a-oder for signs of data exfiltration or compromise
- Review file access logs and network traffic for suspicious activity during the period when a-oder was installed
- Implement package verification and scanning in dependency management workflows to detect malicious packages before installation
Sources
- GitHub Advisory GHSA-6c8w-6hgw-vg3c · GitHub Advisory Database
Cite this entry
"Malicious code in a-oder (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2024; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-a-oder-pypi-1s5tn5
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adv2099m7 (PyPI)
Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adrandom (PyPI)
The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
EsquelesquadPyPICompromised package - resolvedcritical
Malicious code in ziphash (PyPI)
The ziphash package on PyPI contained malicious code that downloads and executes multi-stage malware during archive-support class initialization. The malware exhibits obfuscation and remote code execution capabilities, classified as part of the 2025-11-uzip campaign.
2025 11 UzipPyPICompromised package