Malicious code in adcv (PyPI)
The adcv package on PyPI contained malicious code as part of a campaign by the EsqueleSquad group. The group published nearly 6000 malicious PyPI and NPM packages designed to execute spyware and information-stealing malware.
- Disclosed
- Last updated
- Blast radius
- Potentially thousands of installations; part of a large-scale malicious package campaign affecting nearly 6000 PyPI and NPM packages.
- Ecosystems
- Attack vectors
- Affected entities
- adcvPyPI package containing malicious code
The adcv package published on PyPI was identified as containing malicious code. This package was part of a large-scale coordinated campaign by the EsqueleSquad group to distribute malicious software across package ecosystems.\n\nThe EsqueleSquad group published nearly 6000 malicious packages across PyPI and NPM repositories. These packages were designed to execute spyware and information-stealing malware on systems where they were installed.\n\nThe incident was documented and credited to the OpenSSF's malicious-packages repository, which tracks confirmed malicious package distributions. The specific package adcv was cataloged under identifier MAL-2023-2481.
Indicators of compromise
- Packages
- adcv
Remediation
- Remove the adcv package from all environments where it was installed
- Audit systems that may have installed adcv for signs of compromise, including unauthorized access, data exfiltration, or persistence mechanisms
- Review package dependencies to ensure no other malicious packages from the EsqueleSquad campaign were installed
- Implement package verification and scanning in CI/CD pipelines to detect malicious packages before installation
- Monitor for indicators of compromise related to spyware or information-stealing malware
Sources
- GitHub Advisory GHSA-vc76-ppmr-ghm7 · GitHub Advisory Database
Cite this entry
"Malicious code in adcv (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-adcv-pypi-155e8v
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in adpip (PyPI)
The adpip package on PyPI was identified as malicious code, part of a campaign by EsqueleSquad that published nearly 6000 malicious packages across PyPI and NPM. The package executes spyware and information-stealing malware.
PyPICompromised package - resolvedcritical
Malicious code in adstr (PyPI)
The adstr package on PyPI contained malicious code as part of a campaign by EsqueleSquad group that published nearly 6000 malicious packages across PyPI and NPM. The malicious code executed spyware and information-stealing malware.
PyPICompromised package - resolvedcritical
Malicious code in adtool (PyPI)
The adtool package on PyPI contained malicious code that executed spyware and information-stealing malware. This package was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
PyPICompromised package - resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package