Malicious code in a3s-code (PyPI)
The a3s-code PyPI package contained malicious code that fetched and executed native binaries (.so/.pyd/.dylib) from a GitHub organization (A3S-Lab) distinct from the documented project (AI45Lab), bypassing pip build isolation and hash verification.
- Disclosed
- Last updated
- Blast radius
- All users who imported a3s-code from PyPI
- Ecosystems
- Attack vectors
- Affected entities
- a3s-codePyPI package
The a3s-code package on PyPI contained malicious code in its top-level __init__.py that invoked _bootstrap.ensure_native_loaded() on first import. This function performed an HTTP GET request to https://github.com/A3S-Lab/Code/releases/download/... to fetch platform-specific native binaries (.so, .pyd, or .dylib files), which were written to ~/.cache/a3s-code/ and loaded via importlib.machinery.ExtensionFileLoader, executing arbitrary native code at import time.
The attack exploited a discrepancy between documented and actual code sources. Package metadata (README.md, PKG-INFO, and pyproject.toml) consistently declared the project as github.com/AI45Lab/Code, but the hard-coded fetch URL in _bootstrap.py pointed to github.com/A3S-Lab/Code—a visually similar but distinct GitHub organization. This allowed the attacker to control the native binaries executed on victim machines.
Hash verification was implemented but ineffective: the manifest containing hashes was served from the same base URL as the binaries, and verification was silently skipped if the manifest fetch failed. This provided no integrity guarantee against a compromised fetch source. Users reviewing the documented repository would not discover the actual code being executed on their systems.
The incident was identified and credited to the OpenSSF's malicious-packages project.
Indicators of compromise
- Packages
- a3s-code
- Domains
- github.com/A3S-Lab/Code
Remediation
- Uninstall a3s-code immediately from all affected systems
- Review system logs and process execution history for suspicious native code execution from ~/.cache/a3s-code/
- Audit any systems that imported a3s-code for signs of compromise or data exfiltration
- Use dependency scanning tools to detect a3s-code in project dependencies
- Verify the legitimacy of any similar-named packages before installation, checking both package metadata and actual source URLs
- Consider using pip audit or similar tools to detect known malicious packages
Sources
- GitHub Advisory GHSA-7h9h-pqmg-8fwx · GitHub Advisory Database
Cite this entry
"Malicious code in a3s-code (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-a3s-code-pypi-8zaorf
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in yelp-pkg (PyPI)
yelp-pkg, a malicious package on PyPI, was designed to exfiltrate sensitive data including environment variables during installation. The package overrides the install command in setup.py to execute malicious code and appears to be a typosquatting attack.
PyPICompromised packageTyposquatting - resolvedhigh
Malicious code in adandu (PyPI)
The PyPI package 'adandu' was identified as malicious, containing code to exfiltrate basic system information (hostname, path, username) upon installation or import. The package was part of a broader campaign of pentest-themed malicious packages and communicated with domains associated with malicious activity.
PyPICompromised packageTyposquattingDependency confusion - resolvedhigh
Malicious code in adandv (PyPI)
The adandv package on PyPI contained malicious code designed to exfiltrate basic system information (hostname, path, username) to the package author. The package was part of a broader campaign of malicious pentest-themed packages flooding PyPI.
PyPICompromised packageTyposquattingDependency confusion - resolvedcritical
Malicious code in zamino (PyPI)
The PyPI package zamino was identified as malicious code—a clone of legitimate Aminoapps libraries with added credential exfiltration functionality. The package was part of the 2025-06-sorex campaign and has been cataloged by the OpenSSF malicious packages database.
2025 06 SorexPyPICompromised packageTyposquatting