Malicious code in adafruit-imageload (PyPI)
The adafruit-imageload package on PyPI contained malicious code that exfiltrated basic host information (IP address, username) during installation. The package overrode the install command in setup.py to execute the malicious payload.
- Disclosed
- Last updated
- Blast radius
- PyPI users who installed the malicious adafruit-imageload package
- Ecosystems
- Attack vectors
- Affected entities
- adafruit-imageloadMalicious package on PyPI
The adafruit-imageload package published on PyPI contained malicious code designed to exfiltrate basic system information from the host upon installation or module import. The malicious payload included the host's IP address and username.\n\nThe attack was implemented by overriding the install command in setup.py to execute malicious code during the package installation process. This allowed the attacker to run arbitrary code with the privileges of the user installing the package.\n\nThe package served no legitimate purpose beyond the data exfiltration functionality. This incident was identified and documented by the OpenSSF's malicious-packages project and classified as a typical pentest-style package with limited but real harm potential.\n\nThe incident has been resolved through package removal and public disclosure via GitHub Security Advisories.
Indicators of compromise
- Packages
- adafruit-imageload
Remediation
- Remove adafruit-imageload from all systems where it was installed
- Audit systems that installed this package for signs of compromise or data exfiltration
- Review network logs for suspicious outbound connections from affected systems
- Use dependency scanning tools to detect and prevent installation of known malicious packages
- Monitor PyPI and security advisories for similar malicious packages
Sources
- GitHub Advisory GHSA-qvfx-jf5h-28wc · GitHub Advisory Database
Cite this entry
"Malicious code in adafruit-imageload (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-adafruit-imageload-pypi-zc2tfl
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adv2099m7 (PyPI)
Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adrandom (PyPI)
The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
EsquelesquadPyPICompromised package - resolvedcritical
Malicious code in ziphash (PyPI)
The ziphash package on PyPI contained malicious code that downloads and executes multi-stage malware during archive-support class initialization. The malware exhibits obfuscation and remote code execution capabilities, classified as part of the 2025-11-uzip campaign.
2025 11 UzipPyPICompromised package