Malicious code in abhamzufu (PyPI)
The PyPI package abhamzufu contained malicious code that executed during installation via a compromised setup.py install command override. The package had no legitimate purpose and was part of the 2025-10-wangzhou183 campaign.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation prevalence
- Ecosystems
- Attack vectors
- Threat actor
- Affected entities
- abhamzufuPyPI package with malicious installation code
The PyPI package abhamzufu was identified as malicious by the OpenSSF malicious-packages project. The package overrode the install command in setup.py to execute malicious code during installation, with no legitimate functionality.\n\nThe package was classified as a pentest-style package with low-harm possibilities, suggesting it was designed for testing or exploration rather than widespread damage. It was attributed to the 2025-10-wangzhou183 campaign.\n\nThe malicious behavior was triggered automatically during the pip installation process, making it a direct supply chain compromise of the PyPI ecosystem.
Indicators of compromise
- Packages
- abhamzufu
Remediation
- Remove abhamzufu from any environments where it was installed
- Audit systems that installed this package for signs of compromise
- Review pip installation logs for abhamzufu
- Use dependency scanning tools to detect this package in supply chains
- Monitor for related packages from the 2025-10-wangzhou183 campaign
Sources
- GitHub Advisory GHSA-79j2-6fmh-vwmv · GitHub Advisory Database
Cite this entry
"Malicious code in abhamzufu (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-abhamzufu-pypi-p62oeo
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adv2099m7 (PyPI)
Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adrandom (PyPI)
The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
EsquelesquadPyPICompromised package - resolvedcritical
Malicious code in ziphash (PyPI)
The ziphash package on PyPI contained malicious code that downloads and executes multi-stage malware during archive-support class initialization. The malware exhibits obfuscation and remote code execution capabilities, classified as part of the 2025-11-uzip campaign.
2025 11 UzipPyPICompromised package