Malicious code in aaaazzzzaz (PyPI)
The PyPI package aaaazzzzaz contained malicious code that downloads and executes a remote executable during installation. The package was part of the 2026-06-easyaillm campaign and has been identified and removed.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation prevalence of the malicious package.
- Ecosystems
- Attack vectors
- Threat actor
- Affected entities
- aaaazzzzazPyPI package containing malicious code
The PyPI package aaaazzzzaz was found to contain malicious code designed to download and execute a remote executable during the installation process. The malware employed obfuscation techniques and used mshta as an execution tool.\n\nThis package was identified as part of the 2026-06-easyaillm malicious campaign and is likely related to the 2025-08-raknet-testing-package incident. The malicious intent was clearly established, with the code exhibiting infostealer characteristics.\n\nThe incident was discovered and documented by the OpenSSF's malicious-packages repository (MAL-2026-5874), which tracks confirmed malicious packages across package ecosystems.
Indicators of compromise
- Packages
- aaaazzzzaz
Remediation
- Remove the aaaazzzzaz package immediately from any systems where it was installed
- Audit systems that may have installed this package for signs of compromise or unauthorized executable downloads
- Review package installation logs to identify affected users or deployments
- Implement package verification and scanning in your dependency management workflow
- Monitor for related packages from the 2026-06-easyaillm campaign
Sources
- GitHub Advisory GHSA-qq76-7r5c-664g · GitHub Advisory Database
Cite this entry
"Malicious code in aaaazzzzaz (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-aaaazzzzaz-pypi-o15hw0
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adv2099m7 (PyPI)
Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adrandom (PyPI)
The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
EsquelesquadPyPICompromised package - resolvedcritical
Malicious code in ziphash (PyPI)
The ziphash package on PyPI contained malicious code that downloads and executes multi-stage malware during archive-support class initialization. The malware exhibits obfuscation and remote code execution capabilities, classified as part of the 2025-11-uzip campaign.
2025 11 UzipPyPICompromised package