Malicious code in a3s-code (PyPI)

The a3s-code package on PyPI contained malicious code in its top-level __init__.py that invoked _bootstrap.ensure_native_loaded() on first import. This function performed an HTTP GET request to https://github.com/A3S-Lab/Code/releases/download/... to fetch platform-specific native binaries (.so, .pyd, or .dylib files), which were written to ~/.cache/a3s-code/ and loaded via importlib.machinery.ExtensionFileLoader, executing arbitrary native code at import time.

The attack exploited a discrepancy between documented and actual code sources. Package metadata (README.md, PKG-INFO, and pyproject.toml) consistently declared the project as github.com/AI45Lab/Code, but the hard-coded fetch URL in _bootstrap.py pointed to github.com/A3S-Lab/Code—a visually similar but distinct GitHub organization. This allowed the attacker to control the native binaries executed on victim machines.

Hash verification was implemented but ineffective: the manifest containing hashes was served from the same base URL as the binaries, and verification was silently skipped if the manifest fetch failed. This provided no integrity guarantee against a compromised fetch source. Users reviewing the documented repository would not discover the actual code being executed on their systems.

The incident was identified and credited to the OpenSSF's malicious-packages project.