Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedhigh

Malicious code in adent-core-api (PyPI)

The adent-core-api package on PyPI contained malicious code that exfiltrates basic host information (IP address, username) during installation. The package overrides the install command in setup.py to execute the malicious payload when installed.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
All users who installed the malicious adent-core-api package from PyPI
Ecosystems
PyPI
Attack vectors
Compromised package
Affected entities
  • adent-core-apiPyPI package containing malicious code

The adent-core-api package published on PyPI was found to contain malicious code designed to exfiltrate basic system information from the host machine. The malicious payload is executed during package installation by overriding the install command in setup.py.\n\nThe package has no legitimate functionality beyond the data exfiltration behavior. When installed or imported, it collects information such as the system's IP address and username and transmits this data.\n\nThis incident was identified and documented by the OpenSSF's malicious-packages project (MAL-2024-12188). The package has been classified as a pentest-style malicious package with limited but confirmed harm potential.\n\nUsers who installed this package should assume their basic host information was exfiltrated and take appropriate security measures.

Indicators of compromise

Packages
  • adent-core-api

Remediation

  • Uninstall adent-core-api immediately using pip uninstall adent-core-api
  • Review system logs and network traffic for any suspicious outbound connections from the time of installation
  • Change credentials and review account activity for any systems where this package was installed
  • Scan systems for any additional malicious artifacts or persistence mechanisms
  • Monitor for any unauthorized access or data exfiltration attempts

Sources

  1. GitHub Advisory GHSA-h99w-849w-m476 · GitHub Advisory Database

Cite this entry

"Malicious code in adent-core-api (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-adent-core-api-pypi-xcaxqa

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in adpip (PyPI)

    The adpip package on PyPI was identified as malicious code, part of a campaign by EsqueleSquad that published nearly 6000 malicious packages across PyPI and NPM. The package executes spyware and information-stealing malware.

    PyPICompromised package
  2. resolvedcritical

    Malicious code in adstr (PyPI)

    The adstr package on PyPI contained malicious code as part of a campaign by EsqueleSquad group that published nearly 6000 malicious packages across PyPI and NPM. The malicious code executed spyware and information-stealing malware.

    PyPICompromised package
  3. resolvedcritical

    Malicious code in adtool (PyPI)

    The adtool package on PyPI contained malicious code that executed spyware and information-stealing malware. This package was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.

    PyPICompromised package
  4. resolvedcritical

    Malicious code in afrit-name (PyPI)

    Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.

    PyPICompromised package