Malicious code in aclient-sdk (PyPI)
aclient-sdk on PyPI contains malicious code designed to exfiltrate cloud credentials. The package is a clone of the legitimate aliyun-python-sdk-core with injected code that imports a credential-stealing dependency and exfiltrates AWS/Alibaba Cloud tokens to a remote server.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of aclient-sdk and related packages in the campaign
- Ecosystems
- Attack vectors
- Affected entities
- aclient-sdkMalicious package on PyPI that exfiltrates cloud credentials
aclient-sdk is a malicious package published to PyPI as part of a multi-year credential-theft campaign. The package is a clone of the legitimate aliyun-python-sdk-core library with intentional modifications to client.py that import a malicious dependency (time-check-server or similar) and exfiltrate cloud credentials instead of benign date information.
The campaign operates in two layers: first-stage packages (time-check-server, snapshot-photo) contain code that communicates with a remote server, and second-stage packages (aclient-sdk and variants) clone legitimate cloud SDK libraries and use the first-stage packages as dependencies to steal credentials. Similar variations target AWS clients.
Evidence indicates the campaign has been active for at least two years, with snapshot-photo containing the same credential-theft functionality as newer packages. The malicious intent is clear: credential exfiltration from cloud environments.
This incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- aclient-sdk
- time-check-server
- snapshot-photo
- alicloud-client
Remediation
- Immediately remove aclient-sdk and related packages (time-check-server, snapshot-photo, alicloud-client variants) from all environments
- Audit PyPI package dependencies for any use of these malicious packages
- Rotate all cloud credentials (AWS, Alibaba Cloud) that may have been exposed through systems using these packages
- Review cloud access logs for suspicious activity during the period these packages were installed
- Use only official, verified cloud SDK packages from trusted sources (e.g., aliyun-python-sdk-core from Alibaba Cloud's official repository)
- Implement package pinning and verification in dependency management to prevent installation of typosquatted or malicious variants
Sources
- GitHub Advisory GHSA-9r2q-63q3-w86x · GitHub Advisory Database
Cite this entry
"Malicious code in aclient-sdk (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-aclient-sdk-pypi-1wcjrf
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in acloud-clients (PyPI)
A multi-year malicious campaign on PyPI distributes packages that clone legitimate cloud SDK libraries (acloud-clients, AWS clients) and inject code to exfiltrate cloud credentials via hidden dependencies like time-check-server and snapshot-photo.
PyPICompromised packageMalicious commit - resolvedcritical
Malicious code in acloud-client (PyPI)
A multi-year malicious campaign on PyPI distributed packages (acloud-client, time-check-server, snapshot-photo) that clone legitimate cloud SDK packages and exfiltrate cloud credentials to remote servers. The campaign used obfuscation techniques, hiding malicious functionality in dependency chains.
PyPICompromised packageMalicious commit - resolvedcritical
Malicious code in zscaner (PyPI)
A coordinated malicious package campaign on PyPI targeting Telegram Desktop users. Five interdependent packages (zscaner, pyapiepo, reqinstall, zmaker, zsender) work together to locate, archive, and exfiltrate Telegram Desktop user data to a remote server.
PyPICompromised packageMalicious commit - containedcritical
Malicious code in xyq-drama-skill (PyPI)
xyq-drama-skill, a PyPI package, contained malicious code that downloads and executes an unsigned binary from a remote server during installation and on command invocation. The package masquerades as a Chinese short-video drama script generator but actually deploys what appears to be a COFFLoader beacon.
PyPICompromised packageMalicious commit